CVE-2025-54791: Omero-web Information Disclosure Flaw

CVE-2025-54791 Overview

CVE-2025-54791 is an information disclosure vulnerability in OMERO.web, the web-based client and plugin infrastructure for the Open Microscopy Environment. The flaw affects versions prior to 5.29.2. When an error occurred during a password reset triggered through the Forgot Password feature, the application returned an error message that could disclose information about the targeted user account. The issue is categorized under [CWE-209]: Generation of Error Message Containing Sensitive Information. The maintainers patched the flaw in version 5.29.2 by returning a uniform response regardless of the outcome.

Critical Impact
Unauthenticated attackers can enumerate valid user accounts and gather sensitive account state information through crafted password reset requests over the network.

Affected Products

OMERO.web (openmicroscopy/omero-web) versions prior to 5.29.2
Deployments exposing the Forgot Password functionality (omero.web.show_forgot_password enabled)
OMERO server environments relying on OMERO.web as their user-facing interface

Discovery Timeline

2025-08-13 - CVE-2025-54791 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54791

Vulnerability Analysis

OMERO.web exposes a Forgot Password workflow through the webadmin views module. When a user submits an email or username, the backend calls into the OMERO server to trigger a password reset. In vulnerable versions, the view branched its response based on the outcome of that server call. Successful resets returned a confirmation message, while server-side exceptions (omero.CmdError) surfaced the underlying error parameters directly to the browser. An attacker could submit reset requests for arbitrary identifiers and use the differing error content to distinguish valid accounts, locked accounts, or misconfigured mailboxes from nonexistent users.

Root Cause

The root cause is inconsistent response handling in omeroweb/webadmin/views.py. The exception handler extracted parameters from exp.err.parameters and passed them to the rendered template as the error variable. This behavior violated the principle of returning identical responses for both valid and invalid identifiers in credential recovery flows.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits crafted requests to the Forgot Password endpoint and observes the response body. By iterating through username or email lists, the attacker builds a map of valid accounts and enriches phishing or credential-stuffing campaigns targeting the OMERO deployment.

python

                         conn._waitOnCmd(handle)
                     finally:
                         handle.close()
-                    error = "Password was reset. Check your mailbox."
                     form = None
                 except omero.CmdError as exp:
                     logger.error(exp.err)
-                    try:
-                        error = exp.err.parameters[exp.err.parameters.keys()[0]]
-                    except Exception:
-                        error = exp
+
+                # always return the same message to prevent information leakage
+                error = "Password was reset. Check your mailbox."
+
     else:
         form = ForgottonPasswordForm()

Source: GitHub commit 8aa2789. The patch removes the exception-derived error string and returns the same generic message for every code path.

Detection Methods for CVE-2025-54791

Indicators of Compromise

High volumes of POST requests to the OMERO.web Forgot Password endpoint from a single source or a distributed set of IPs
Sequential or dictionary-style values in username or email fields submitted to the password reset form
HTTP responses from vulnerable OMERO.web instances containing OMERO command error parameters instead of the generic reset confirmation

Detection Strategies

Inspect web server and reverse proxy logs for repeated requests to the webadmin password reset URL paired with varying identifiers
Compare response body size and content on the reset endpoint; divergent responses in vulnerable versions indicate probing activity
Enable application-level logging around omero.CmdError events to surface enumeration attempts hitting the exception path

Monitoring Recommendations

Alert on burst patterns of password reset submissions above a baseline threshold per source IP or session
Correlate reset attempts with subsequent authentication attempts on the same accounts to identify credential-stuffing follow-ups
Track the installed OMERO.web version across environments and flag hosts still running releases earlier than 5.29.2

How to Mitigate CVE-2025-54791

Immediate Actions Required

Upgrade OMERO.web to version 5.29.2 or later on all production and staging deployments
Audit reverse proxy and application logs for prior enumeration activity against the Forgot Password endpoint
Apply rate limiting on the password reset URL at the web server or WAF layer to slow automated probing

Patch Information

The fix is available in OMERO.web 5.29.2. Review the GHSA-gpmg-4x4g-mr5r advisory and the upstream commit for verification details. The patch guarantees a uniform "Password was reset. Check your mailbox." response across success and failure paths.

Workarounds

Disable the Forgot Password feature by setting the omero.web.show_forgot_password configuration property to false
Restrict access to the OMERO.web administrative endpoints via network ACLs or VPN until the upgrade is completed
Front the deployment with a WAF rule that normalizes reset responses or blocks high-frequency reset submissions

bash

# Disable the Forgot Password option until the upgrade is applied
omero config set omero.web.show_forgot_password false
omero web restart