---
title: "TYPO3-PSA-2019-002: Username and Email Address Enumeration"
url: "https://news.typo3.com/security/advisory/typo3-psa-2019-002"
description: It has been discovered, that usernames and email addresses may be enumerated with brute-force techniques, when using validators in order to ensure a unique username or email address.
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
categories:
  - "Developer & Technology"
  - Public Service Announcement
---

# TYPO3-PSA-2019-002: Username and Email Address Enumeration

- [Developer & Technology](https://news.typo3.com/article/category/developer-technology)
- Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement)

TYPO3-PSA-2019-002: Username and Email Address Enumeration
==========================================================

22 January 2019

![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp)

It has been discovered, that usernames and email addresses may be enumerated with brute-force techniques, when using validators in order to ensure a unique username or email address.

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy)

- **Release Date:** January 22, 2019
- **Component Type:** 3rd party extensions (not being part of TYPO3 default installation)
- **Impact:** Enumeration of usernames and email addresses, Information Disclosure
- **Type:** Advisory

### Problem Description

TYPO3 extensions, which allow to create frontend user accounts or newsletter subscriptions, typically use server side validators to ensure that a given username or email address is unique.

Validation results - like *"A user with the given username already exist"* or *"This email address is already subscribed to the newsletter"* - allow remote users to create a list of usernames and email addresses of frontend users or newsletter subscribers of the TYPO3 website.

This information can be used to attack the TYPO3 frontend login, for example, through a brute-force or a username/password attack. In some cases (e.g. sites with information for special target groups) this behavior can also be seen as an information disclosure.

### Advised Solution

To classify possible enumeration of email and usernames as **security and privacy risk** depends on individual **scenarios and the overall requirements** of a web application. Basically the scope is to respond with generic messages without revealing details to third parties.

To avoid username and email address enumeration *in general*, the following process is **suggested**.

#### Frontend user registration

1. Do not use validators, which check for uniqueness of username and email address field values
2. Check for username and email address uniqueness on server side before saving the new frontend user
    - If an account with the username or email address exist, send an email with password recovery instructions to user (frontend user must contain a valid email address)
    - If no account with username or email address exist, create new account with provided user data and proceed with following registration steps (e.g. send opt-in email)
3. Display a generic message without providing information about existing accounts (e.g. *"An email with further registration instructions has been sent."*)

Some TYPO3 extensions for frontend user management (e.g. *femanager*, *sf\_register* or *sr\_feuser\_register*) contain signal slots or hooks, which may be used to implement the suggested process.

#### Newsletter subscription

1. Do not use validators to check the uniqueness of an email address
2. Check email address uniqueness on server side before saving the newsletter subscription
    - If email address is already subscribed to the newsletter, ignore registration and do not save data
    - If email address is not subscribed to the newsletter, save registration and proceed with following subscription steps (e.g. send opt-in email)
3. Display a general message (e.g. *"An email with further registration instructions has been sent."*)

### Credits

Thanks to Loek Hilgersom who reported this issue

### General Advice

Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security-guidelines). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list.

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg)

About the Author

[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy)

[More posts by this author](https://news.typo3.com/article/author/zoe-legacy)