Executive brief
UJCMS is an open-source Java content management system used to build and manage websites. An authorization flaw allows unauthenticated attackers to enumerate valid usernames, email addresses, and phone numbers through API endpoints, potentially enabling account targeting for further attacks or credential stuffing.
Technical details
The UserController class exposes multiple endpoints (/username-exist, /mobile-exist, /email-exist, etc.) that check user existence without proper authorization controls, allowing any network attacker to enumerate registered accounts. The vulnerability stems from missing permission annotations on these API methods, making them accessible without authentication. This information disclosure enables downstream attacks such as targeted phishing or password reset enumeration.
Affected products
- Dromara UJCMS up to 12.3.1
Timeline
- 2026-09-20: disclosed
- 2026-08-23: other: Vulnerability reported via GitHub issue