CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.

• CWE-203

• https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1Patch, Third Party Advisory
• https://github.com/argoproj/argo-cd/pull/3215Patch, Third Party Advisory
• https://www.soluble.ai/blog/argo-cves-2020Third Party Advisory
• https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1Patch, Third Party Advisory
• https://github.com/argoproj/argo-cd/pull/3215Patch, Third Party Advisory
• https://www.soluble.ai/blog/argo-cves-2020Third Party Advisory

Published

Apr 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11558An issue was discovered in libgpac.a in GPAC 0.8.0, as demon…9.8
• CVE-2020-1156An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11560NCH Express Invoice 7.25 allows local users to discover the …7.8
• CVE-2020-11561In NCH Express Invoice 7.25, an authenticated low-privilege …8.8
• CVE-2020-11565An issue was discovered in the Linux kernel through 5.6.2. m…6
• CVE-2020-1157An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11579An issue was discovered in Chadha PHPKB 9.0 Enterprise Editi…7.5
• CVE-2020-1158An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11580An issue was discovered in Pulse Secure Pulse Connect Secure…9.1
• CVE-2020-11581An issue was discovered in Pulse Secure Pulse Connect Secure…8.1
• CVE-2020-11582An issue was discovered in Pulse Secure Pulse Connect Secure…8.8
• CVE-2020-11583A GET-based XSS reflected vulnerability in Plesk Obsidian 18…6.1