CVE-2026-19965
Received Received - Intake

Information Disclosure in Automad CMS

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19965
EUVD
EUVD-2026-60010

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcantondahmen automad to 2.0.0-beta.32 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a username enumeration issue in the Automad CMS password reset endpoint. It allows attackers to determine valid usernames or email addresses by observing different responses for existing versus non-existing accounts. The system returns a server error for valid accounts and a generic message for invalid ones, enabling account discovery.

Detection Guidance

To detect this vulnerability, monitor the password reset endpoint /_api/user/request-password-reset-token for inconsistent responses. Send requests with valid and invalid usernames/emails and check if the server returns different error messages. Use tools like curl to test responses. Example: curl -X POST https://example.com/_api/user/request-password-reset-token -d 'name-or-email=validuser' and compare with curl -X POST https://example.com/_api/user/request-password-reset-token -d 'name-or-email=invaliduser'.

Impact Analysis

This vulnerability can allow attackers to identify valid accounts, which may lead to targeted brute-force attacks, phishing campaigns, or unauthorized access. It could also enable abuse of the password reset endpoint due to lack of rate limiting.

Compliance Impact

This vulnerability enables username enumeration, which could allow attackers to identify valid accounts. This may violate GDPR principles of data minimization and security, as unauthorized disclosure of user existence could lead to privacy breaches. For HIPAA, if the system handles protected health information, account enumeration could facilitate unauthorized access to sensitive data.

Mitigation Strategies

Upgrade to Automad version 2.0.0-beta.33 or later to resolve the issue. Apply the patch eac0b05dafdb0ddf8b9139dad8929aaba86568ca. Ensure the password reset endpoint returns identical responses for valid and invalid accounts to prevent user enumeration. Implement rate limiting on the endpoint to prevent abuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19965. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart