CVE-2025-67806: Sagedpw Sage Dpw

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.

Affected products

• Sagedpw Sage Dpw: version 2025_06_004 only

Published 2026-04-01. Last modified 2026-06-17.