CVE-2021-39189

Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.

• CWE-204
• CWE-203

• https://github.com/pimcore/pimcore/pull/10223.patchPatch, Third Party Advisory
• https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dcePatch, Third Party Advisory
• https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9Third Party Advisory
• https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c/Third Party Advisory
• https://github.com/pimcore/pimcore/pull/10223.patchPatch, Third Party Advisory
• https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dcePatch, Third Party Advisory
• https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9Third Party Advisory
• https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c/Third Party Advisory

Published

Sep 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39182EnroCrypt is a Python module for encryption and hashing. Pri…7.5
• CVE-2021-39183Owncast is an open source, self-hosted live video streaming …6.1
• CVE-2021-39184Electron is a framework for writing cross-platform desktop a…8.6
• CVE-2021-39185Http4s is a minimal, idiomatic Scala interface for HTTP serv…9.1
• CVE-2021-39186GlobalNewFiles is a MediaWiki extension maintained by Mirahe…6.1
• CVE-2021-39187Parse Server is an open source backend that can be deployed …7.5
• CVE-2021-3919A potential security vulnerability has been identified in OM…9.8
• CVE-2021-39190The SCCM plugin for GLPI is a plugin to synchronize computer…5.3
• CVE-2021-39191mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-39192Ghost is a Node.js content management system. An error in th…7.2
• CVE-2021-39193Frontier is Substrate's Ethereum compatibility layer. Prior …5.3
• CVE-2021-39194kaml is an open source implementation of the YAML format wit…6.5