CVE-2020-19137: Autumn Project Autumn

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10".

Affected products

• Autumn Project Autumn: up to and including 1.0.4

Published 2021-09-08. Last modified 2026-06-17.