{"id":"EUVD-2026-28551","enisaUuid":"072ef4fb-efd2-31e6-83bd-60f957bb4c03","description":"Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application\u0027s response time. This issue has been patched in version 2.2.0.","datePublished":"May 8, 2026, 1:00:54 PM","dateUpdated":"May 11, 2026, 6:24:40 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/Sync-in/server/security/advisories/GHSA-43fj-qp3h-hrh5\nhttps://github.com/Sync-in/server/releases/tag/v2.2.0\n","aliases":"CVE-2026-41161\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"93efba09-3f49-35cc-8e11-58b47189d21d","product":{"name":"Server","vendor":{"name":"Devolutions"}},"product_version":"\u003c 2.2.0"}],"enisaIdVendor":[{"id":"82698852-b7b7-3730-9e96-c5d5a8e7bfc3","vendor":{"name":"Sync-in"}}],"enisaIdVulnerability":[{"id":"72878088-4e7e-3250-ba49-74ff7adf6016","vulnerability":{"id":"CVE-2026-41161","description":"Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application\u0027s response time. This issue has been patched in version 2.2.0.","datePublished":"May 8, 2026, 1:00:54 PM","dateUpdated":"May 11, 2026, 6:24:40 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/Sync-in/server/security/advisories/GHSA-43fj-qp3h-hrh5\nhttps://github.com/Sync-in/server/releases/tag/v2.2.0\n","enisa_id":"EUVD-2026-28551\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 5, 2026, 7:16:41 AM","vulnerabilityProduct":[{"id":"c2e204b3-d192-3eae-b27c-0d6b9585f940","product":{"name":"Server","vendor":{"name":"Devolutions"}},"product_version":"\u003c 2.2.0"}],"vulnerabilityVendor":[{"id":"a775f3b9-d0aa-3160-918f-d8911188dc5d","vendor":{"name":"Sync-in"}}]}}],"enisaIdAdvisory":[]}