CVE-2025-41066 Disclosure of sensitive information in Horde Groupware

Medium 6.9 Published 2 Dec 2025 Updated 2 Dec 2025

Unauthenticated attackers can enumerate valid user accounts in Horde Groupware by observing server responses to attachment requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-41066?

CVE-2025-41066 is a medium-severity vulnerability in Horde Groupware, published on 2 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.

Weakness: CWE-200

Which versions are affected by CVE-2025-41066?

It affects 1 product.

Products include Horde Groupware.

How do I fix CVE-2025-41066?

No fix has been published for CVE-2025-41066 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-41066 being exploited?

There is no known exploitation of CVE-2025-41066 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2025-41066, GHSA-j5gg-5w34-g43r, UBUNTU-CVE-2025-41066.