CVE-2025-54791: OMERO.web Exposes User Information During Password Reset
Summary
CVE-2025-54791: OMERO.web displays unecessary user information when requesting password reset. Affects omero-web versions < 5.29.2. Fixed in 5.29.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OMERO.web is a web-based interface for the OMERO platform, which is designed for managing and sharing scientific image data. It provides functionalities such as user management, image visualization, and data sharing. However, it has a vulnerability that can expose sensitive user information when errors occur during the password reset process.
Vulnerability Detail
The vulnerability arises from improper error handling in the 'Forgot Password' feature of OMERO.web. When a user attempts to reset their password and an error occurs, the system may display error messages that inadvertently reveal information about the user. This could potentially allow an attacker to gather sensitive information about users, leading to further security risks.
How To Fix
Latest published version: 5.33.2 as of 22 Oct 2026
pip install --upgrade "omero-web==5.33.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.29.2
This is the first release that contains the fix.
pip install --upgrade "omero-web==5.29.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, you can disable the 'Forgot Password' option in OMERO.web by modifying the configuration property. Set the following in your configuration file: omero.web.show_forgot_password = False.
Conclusion
In summary, CVE-2025-54791 is a moderate severity vulnerability in OMERO.web that can expose user information during password reset attempts. Users are advised to upgrade to version 5.29.2 or higher to mitigate this risk. For immediate concerns, disabling the 'Forgot Password' feature is recommended.
See every vulnerability recorded for omero-web →
FAQ
CVE-2025-54791 is a vulnerability in OMERO.web that allows sensitive user information to be exposed during the password reset process.
OMERO.web versions prior to 5.29.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider disabling the 'Forgot Password' feature as a temporary workaround.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for omero-web.
