CVE-2026-81033

Katalog CVE

CVSS 5.3 · Medium EPSS 0,48%

Kerentanan Observable Response Discrepancy. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.

Rincian

Terbit di NVD

26 Agustus 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/automatisch/automatisch
• https://github.com/automatisch/automatisch/blob/v0.15.0/packages/backend/src/controllers/internal/api/v1/users...
• https://github.com/automatisch/automatisch/issues/2713
• https://www.vulncheck.com/advisories/automatisch-through-0.15.0-user-enumeration-via-forgot-password-response-...