CVE-2025-41066

Name	CVE-2025-41066
Description	Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1123000

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-horde-groupware (PTS)	sid, bookworm, bullseye	5.2.22-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php-horde-groupware	source	(unstable)	(unfixed)			1123000

Notes

[bookworm] - php-horde-groupware <no-dsa> (Minor issue)
[bullseye] - php-horde-groupware <no-dsa> (Minor issue)
https://www.incibe.es/en/incibe-cert/notices/aviso/disclosure-sensitive-information-horde-groupware