Configured Commerce: COM-2026-04 - User Enumeration

Updated November 10, 2026 21:16

Brief Description:

A low-severity issue concerning user enumeration was identified in the Commerce B2B application which allows a user to infer valid user accounts via a large X-ServerTime header response.

Affected Versions:

All versions before 5.2.2605.

Solutions and Mitigations:

The application has been updated to fully remove the X-ServerTime header which is no longer required.

CVSS and Severity:

CVSS 3.1, Low

CVE/CWE ID:

CWE-204

Configured Commerce: COM-2026-04 - User Enumeration

<%= previousTitle %>

<%= nextTitle %>

In this article

<%= heading %>

<% if (!block.description) { %> <%= block.name %> <% } else { %> <%= block.name %> <% } %>

<%= heading %>

<% if (!block.description) { %> <%= parsed.title %> <% } else { %> <%= parsed.title %> <% } %>

User Research

Security Announcements

Still have questions?

Categories

Toggle navigation menu

<%= category.name %>