CVE-2026-81033

Received Received - Intake

Information Disclosure in Automatisch Forgot-Password Endpoint

Publication date: 2026-08-26

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-28

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-81033

EUVD

EUVD-2026-66609

Affected Vendors & Products

Vendor	Product	Version / Range
automatisch	automatisch	to 0.15.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability allows attackers to determine if an email address is registered in the Automatisch system by exploiting the forgot-password endpoint. The system responds differently to registered and unregistered addresses, enabling enumeration of user accounts without authentication or rate limiting.

Detection Guidance

This vulnerability can be detected by sending requests to the forgot-password endpoint and comparing HTTP status codes. Registered addresses return 204 No Content while unregistered addresses return 404 Not Found. Automated scripts can test candidate email addresses and observe the responses.

Impact Analysis

Attackers could use this to identify valid user accounts, which may lead to targeted phishing attacks, credential stuffing, or social engineering attempts against those users. It compromises user privacy by exposing account existence.

Compliance Impact

This vulnerability likely violates privacy principles under GDPR (data minimization, purpose limitation) and HIPAA (access controls, safeguards for PHI). It exposes personal data (email addresses) without proper protection, risking non-compliance with these regulations.

Mitigation Strategies

Immediately disable the forgot-password endpoint or restrict access to authenticated users only. Implement rate limiting and remove the status code discrepancy between registered and unregistered addresses. Review logs for suspicious activity and consider notifying affected users.

Hi! I’m here to help you understand CVE-2026-81033. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70