CVE-2026-19205

CVE-2026-19205 is an observable response discrepancy (CWE-204) in GastroMenum Web Panel: the application replies differently depending on whether an account exists, typically on unauthenticated pages such as the sign-in flow. A network attacker needs no credentials or user interaction and can trigger the flaw simply by probing the panel with candidate account names and comparing the responses. The result is account footprinting — the attacker learns which accounts/usernames are valid — which the CVSS score rates as high confidentiality impact (C:H) with no integrity or availability impact, yielding a target list for follow-on credential-guessing attacks. Any deployment of GastroMenum Web Panel older than the 31.08.2026 release is affected, particularly panels reachable from the internet. There is currently no known public proof-of-concept, no entry in CISA KEV, and a low EPSS (0.2%, 16th percentile), indicating no confirmed exploitation in the wild.

What to do: Upgrade GastroMenum Web Panel to the 31.08.2026 (August 31, 2026) release or later. Until patched, reduce exposure of the panel (IP allowlisting/VPN or firewall restrictions) and consider rate-limiting or normalizing authentication responses via a reverse proxy/WAF to blunt enumeration attempts. Review access logs for bursts of sign-in or username-probing requests from unknown sources.