CVE-2026-81033

MediumCVSS 5.3

Published: 26/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 26/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

Automatisch reveals whether an address is registered through the response to its forgot-password request. The route is mounted without authentication and without rate limiting, allowing account enumeration.

Risk Assessment

An attacker can determine which email addresses are registered in the system, which can be used for phishing or social engineering attacks.

Recommendation

Change the response behavior for password reset requests to not reveal account status, and add rate limiting.

Other vulnerabilities in Automatisch

CVE-2026-72566High
A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action.

Original NVD description (English source)

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.