CVE-2020-11576: 
Argo CD vulnerability analysis and mitigation

Argo CD version v1.5.0 was vulnerable to a user-enumeration vulnerability (CVE-2020-11576) which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise. The vulnerability was discovered in April 2020 and was fixed in version v1.5.1 (NVD).

The vulnerability has a CVSS v3.1 Base Score of 5.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-203 (Observable Discrepancy). The issue occurred in the API endpoint /api/v1/session which revealed different HTTP response codes based on whether a username existed or not (NVD, AttackerKB).

The vulnerability allowed attackers to enumerate valid usernames in the system by observing different HTTP response codes. This could enable attackers to identify valid accounts for further targeted attacks like password brute-forcing (NVD).

The vulnerability was fixed in Argo CD version v1.5.1. Users should upgrade to this version or later to mitigate the issue. The fix ensures consistent error responses regardless of whether a username exists or not (GitHub Patch).