CVE-2019-3990

4.3 mediumEPSS 1.0%

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the "search" functionality.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2019-12-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

linuxfoundation:harbor

References

https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg
https://www.tenable.com/security/research/tra-2019-50
https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg
https://www.tenable.com/security/research/tra-2019-50

Check your stack JSON