CVE-2023-38871: Economizzer

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.

Affected products

• Economizzer Economizzer: version 0.9 only; version april_2023 only

Published 2023-09-28. Last modified 2026-06-17.