Sage DPW vulnerabilities

The login mechanism of Sage DPW 2025_06_004 returns distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.

The login mechanism of Sage DPW 2021_06_004 returns distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.

A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints in the Database Monitor feature, exposing sensitive information such as hashes and table names. The feature is disabled by default, never available in Sage DPW Cloud, and was forcibly disabled again in version 2025_06_003.