Authenticated username enumeration via response timing

Observable timing discrepancy in DivvyDrive Web 4.8.2.2 through 4.8.2.14 allows remote authenticated users to enumerate usernames. The CNA identifies cross-domain search timing as the observable channel but does not disclose the affected endpoint or the operation whose duration varies with username validity. Low-privileged network access is required, and the documented consequence is disclosure of whether tested usernames exist.