{"id":"CVE-2019-3990","details":"A User Enumeration flaw exists in Harbor. The issue is present in the \"/users\" API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the \"search\" functionality.","aliases":["GHSA-6qj9-33j4-rvhg"],"modified":"2026-10-20T10:50:55.589253074Z","published":"2019-12-03T17:15:11.727Z","database_specific":{},"references":[{"type":"ADVISORY","url":"https://www.tenable.com/security/research/tra-2019-50"},{"type":"FIX","url":"https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/goharbor/harbor","events":[{"introduced":"8017a20e0c04a66367d71d6a9ea80c8430ee51ef"},{"last_affected":"afb558e7bcab81e98e56036f1e493cb5a3823a53"},{"introduced":"9b073a1941df311f30911b59751280e68158550d"},{"last_affected":"88a4353edf00361ee7d0799ab3c13378d0de32e3"},{"introduced":"31b34e3658116e74d1ef3dd713a681765288018c"},{"last_affected":"c90c264f6969583f7ce3a977b1d57bd685dc2fa8"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*","range":[{"introduced":"1.7.0"},{"last_affected":"1.7.6"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:linuxfoundation:harbor:*:*:*:*:*:*:*:*","range":[{"introduced":"1.8.0"},{"last_affected":"1.8.5"}],"source":"CPE_RANGE"},{"range":[{"introduced":"1.9.0-NA"},{"last_affected":"1.9.0-NA"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:linuxfoundation:harbor:1.9.0:-:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:linuxfoundation:harbor:1.9.0:rc1:*:*:*:*:*:*","range":[{"introduced":"1.9.0-rc1"},{"last_affected":"1.9.0-rc1"}],"source":"CPE_STRING"},{"range":[{"introduced":"1.9.0-rc2"},{"last_affected":"1.9.0-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:linuxfoundation:harbor:1.9.0:rc2:*:*:*:*:*:*"},{"range":[{"introduced":"1.9.1-NA"},{"last_affected":"1.9.1-NA"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:linuxfoundation:harbor:1.9.1:-:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:linuxfoundation:harbor:1.9.1:rc1:*:*:*:*:*:*","range":[{"introduced":"1.9.1-rc1"},{"last_affected":"1.9.1-rc1"}],"source":"CPE_STRING"}]}}],"versions":["1.9.0-NA","1.9.0-rc1","1.9.0-rc2","1.9.1-NA","1.9.1-rc1","v1.7.6-rc1","v1.7.6","v1.8.5-rc1","v1.8.5","v1.8.4-rc1","v1.8.4","v1.9.1-rc1","v1.8.3","v1.9.0","v1.8.3-rc1","v1.8.2-rc1","v1.8.2-rc2","v1.8.2","v1.8.1","v1.8.0","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3990.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}