Username Enumeration in CasaOS via bypass of CVE-2024-24766
Priority HIGH 66CWE-204Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-204.
Summary
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00618 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/IceWhaleTech/CasaOS-UserService (Go): 0.4.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IceWhaleTech | CasaOS-UserService | = 0.4.7 | — | No fix listed | CNA |
| — | github.com/IceWhaleTech/CasaOS-UserService (Go) | 0.4.7 to before 0.4.8 | 0.4.8 | Patch available | GHSA-hcw2-2r9c-gc6p |
- CasaOS-UserService VendorIceWhaleTech Affected = 0.4.7 Fixed in — No fix listed CNA
- github.com/IceWhaleTech/CasaOS-UserService (Go) Vendor— Affected 0.4.7 to before 0.4.8 Fixed in 0.4.8 Patch available GHSA-hcw2-2r9c-gc6p
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:icewhale:casaos-userservice:0.4.7:-:*:*:*:*:*:* | 0.4.7 | Vulnerable | IceWhaleTech |
- cpe:2.3:a:icewhale:casaos-userservice:0.4.7:-:*:*:*:*:*:* Versions 0.4.7 Vulnerable ·IceWhaleTech
Remediation
- Fix · GHSA-hcw2-2r9c-gc6p github.com/IceWhaleTech/CasaOS-UserService (Go) Fixed in 0.4.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28232
- 2026-10-03 Alias added: GHSA-hcw2-2r9c-gc6p
References
Patch 1
More IceWhaleTech Casaos-userservice vulnerabilities
- TI-2024-16283 CasaOS Username Enumeration CVSS 3.1HIGH 7.5
Sources
- CVE-2024-28232 · CVE Program
- CVE-2024-28232 · NVD
- FIRST EPSS
- GHSA-hcw2-2r9c-gc6p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences