CVE-2025-67807: Sagedpw Sage Dpw

Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days.

The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behaviour in newer versions.

Affected products

• Sagedpw Sage Dpw: version 2025_06_004 only

Published 2026-04-01. Last modified 2026-06-17.