Cacti EUVD-2026-109089

No special configuration is required: an attacker only needs network reachability to the Cacti web login form, then submits usernames and compares the capitalization of the word 'failed'/'Failed' in the 'Access Denied!' response to distinguish existing accounts from non-existent ones. The exploitation ceiling is inherently limited - the flaw discloses only username validity (C:L), yielding no authentication bypass, data read, or code execution on its own. Practical limiting factors: the login interface must be network-accessible to the attacker (monitoring consoles are frequently restricted to internal networks), the installation must be at or below version 1.2.30, and the value is only realized when chained into a follow-on brute-force, credential-stuffing, or social-engineering attack.

This is a genuinely low-to-moderate priority information-disclosure issue, not a critical flaw, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N = 5.3 Medium) correctly reflects a remotely reachable, unauthenticated, low-complexity bug whose only impact is a limited confidentiality leak - the ability to tell valid from invalid usernames. There is no integrity or availability impact and no code execution. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the severity. No EPSS score and no CISA KEV entry are provided in the input, so there is no evidence of active or widespread exploitation; absence of these does not raise priority. A public PoC reference exists in the GitHub security advisory (screenshots plus reproduction steps), but it is a demonstration of the enumeration behavior rather than verified weaponized exploit code. The realistic danger is as a precursor: enumerated usernames feed brute-force, credential-stuffing, or social-engineering campaigns. No data points conflict here; the chief limitation is that exploitability depends on the Cacti login interface being network-reachable, which for a monitoring console is often internal-only.

An attacker who can reach the Cacti login page submits a list of candidate usernames and inspects each failure response: a valid account returns 'Access Denied! Login failed.' while an unknown account returns 'Access Denied! Login Failed.', the sole difference being the capital 'F'. A public PoC reference (with screenshots and steps) exists in the GHSA advisory, demonstrating the technique. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only unauthenticated network access and no user interaction, letting the attacker build a confirmed username list to seed later password attacks.