CVE-2025-54791 json
OMERO.web displays unecessary user information when requesting to reset the password
published 2025-08-13 14 mo ago modified 2026-07-07 4 mo ago also EUVD-2025-24567 , GHSA-gpmg-4x4g-mr5r , PYSEC-2026-1717
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | omero-web | <5.29.2 |
5.29.2 |
Affected products
- ome omero-web
Classification
- Weakness
-
- CWE-209 Generation of Error Message Containing Sensitive Information
References
-
github.com
/ome/omero-web/commit/8aa2789e8f759c73f1517abe9a0abd44e86644ad
web, patch
-
github.com
/ome/omero-web/security/advisories/GHSA-gpmg-4x4g-mr5r
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-54791
advisory
-
github.com
/ome/omero-web
package
-
pypi.org
/project/omero-web
package
-
github.com
/advisories/GHSA-gpmg-4x4g-mr5r
advisory
Sources
- CVE List CVE-2025-54791
- GitHub Advisory GHSA-gpmg-4x4g-mr5r
- NVD CVE-2025-54791
- OSV PYSEC-2026-1717
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.