Difuse vulnerabilities
Published CVEs affecting Difuse products: 2 record(s), with severity, exploitation and fixes.
CVE-2025-65900
Medium · 6.5
CWE-863 Dec 4, 2025
Incorrect Authorization in Difuse Kalmia
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all platform users.
CVE-2025-65899
Medium · 5.3
CWE-204 Dec 4, 2025
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication…
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_password). This observable response discrepancy allows unauthenticated attackers to enumerate valid usernames on the system.