CVE-2025-41066: Horde Groupware Enumeration Vulnerability

CVE-2025-41066 Overview

CVE-2025-41066 is a user enumeration vulnerability in Horde Groupware v5.2.22. The flaw exists in the /imp/attachment.php endpoint, which responds differently based on whether a supplied username is valid. An unauthenticated remote attacker can send HTTP requests containing the id and u parameters to determine which accounts exist on the system. Valid usernames trigger the download of an empty file, while invalid usernames produce no download response. This behavioral difference enables attackers to enumerate accounts at scale without authentication. The issue is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can enumerate valid Horde Groupware accounts remotely, enabling targeted credential attacks against confirmed users.

Affected Products

Horde Groupware 5.2.22
Horde IMP webmail component (/imp/attachment.php)
Deployments exposing the Horde web interface to untrusted networks

Discovery Timeline

2025-12-02 - CVE-2025-41066 published to NVD
2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-41066

Vulnerability Analysis

The vulnerability resides in the attachment handler at /imp/attachment.php within the Horde IMP webmail module. The script accepts two parameters in the HTTP request: id and u, where u specifies a target username. The server processes the request differently depending on whether the supplied user exists in the system.

When the username is valid, the server initiates a file download response, even when the resulting file is empty. When the username does not exist, the server returns a response that does not trigger any file download. An attacker can compare the two response patterns to infer account validity with high confidence.

This discrepancy creates a reliable oracle for username enumeration. Attackers can automate requests against common username lists, email prefixes, or harvested data to compile valid accounts for the target Horde deployment.

Root Cause

The root cause is improper handling of user existence checks in the attachment retrieval flow. The application differentiates server responses based on internal validation results instead of returning a uniform response for both valid and invalid inputs. This violates the principle of indistinguishable responses for authentication-adjacent operations.

Attack Vector

The attack vector is the network. Exploitation requires no authentication, no user interaction, and no privileges. An attacker sends crafted HTTP GET or POST requests to /imp/attachment.php with chosen id and u parameter values. By observing whether the server initiates a download, the attacker confirms account existence. The enumerated accounts can then feed credential stuffing, password spraying, or targeted phishing campaigns against confirmed users.

No verified public exploit code is currently available. The behavior described in the advisory can be reproduced by issuing standard HTTP requests against the vulnerable endpoint. See the INCIBE CERT Notice on Horde for technical details.

Detection Methods for CVE-2025-41066

Indicators of Compromise

Repeated HTTP requests to /imp/attachment.php containing varying values of the u parameter from a single source IP
High-volume request patterns to the IMP attachment endpoint outside normal user activity windows
Sequential or dictionary-style username values appearing in the u query parameter

Detection Strategies

Deploy web server log analysis rules that flag enumeration patterns against /imp/attachment.php, focusing on request frequency and parameter variability
Configure web application firewall (WAF) rules to identify automated tooling signatures targeting the IMP attachment handler
Correlate authentication failures with prior requests to the attachment endpoint from matching source addresses

Monitoring Recommendations

Monitor HTTP response codes and Content-Disposition headers returned by /imp/attachment.php to detect scanning activity
Alert on source IPs issuing more than a defined threshold of requests to the attachment endpoint within short time windows
Track downstream login attempts following bulk requests to the IMP attachment URL to identify enumeration-then-attack chains

How to Mitigate CVE-2025-41066

Immediate Actions Required

Restrict external access to the Horde Groupware web interface using network controls, VPN, or IP allowlisting until a patched version is deployed
Apply rate limiting and throttling rules on /imp/attachment.php to slow automated enumeration attempts
Review web server logs for historical enumeration activity targeting the attachment endpoint and identify accounts that may have been confirmed

Patch Information

As of the last NVD update on 2025-12-03, no vendor patch is referenced in the advisory. Administrators running Horde Groupware 5.2.22 should consult the INCIBE CERT Notice on Horde and the Horde project channels for fix availability. Apply any subsequent security release that addresses the response discrepancy in the IMP attachment handler.

Workarounds

Place the Horde application behind a reverse proxy or WAF that normalizes responses for /imp/attachment.php, returning identical HTTP status codes and headers regardless of username validity
Enforce authentication at the proxy layer so unauthenticated requests cannot reach the vulnerable endpoint
Implement strict rate limiting per source IP for requests carrying the u parameter to the IMP attachment URL

bash

# Example nginx configuration to limit and restrict the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=imp_attach:10m rate=5r/m;

location = /imp/attachment.php {
    limit_req zone=imp_attach burst=5 nodelay;
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://horde_backend;
}