CVE-2026-82043

Received Received - Intake

Account Enumeration in UTMStack

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-02

Generated

2026-10-03

AI Q&A

2026-10-03

EPSS Evaluated

N/A

NVD

CVE-2026-82043

EUVD

EUVD-2026-91798

Affected Vendors & Products

Vendor	Product	Version / Range
utmstack	utmstack	to 11.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

UTMStack before version 11.2.16 has an account enumeration vulnerability. This flaw allows unauthenticated attackers to check if specific email addresses are registered on the system by exploiting the password reset endpoint. When an attacker submits an email address, the system responds differently for registered versus unregistered accounts, revealing valid accounts through HTTP status codes.

Detection Guidance

To detect this vulnerability, monitor HTTP responses from the POST /api/account/reset-password/init endpoint. Registered emails return 200 OK while unregistered emails trigger 500 Internal Server Error with backend details. Use tools like curl to test endpoints with random email addresses and observe response codes.

Impact Analysis

This vulnerability enables attackers to identify valid user accounts, which can lead to targeted phishing attacks or credential stuffing attempts. Attackers may use the exposed email addresses to craft convincing phishing emails or brute-force login credentials for registered accounts.

Mitigation Strategies

Upgrade UTMStack to version 11.2.16 or later. If immediate upgrade is not possible, restrict access to the /api/account/reset-password/init endpoint via firewall rules or web application firewall (WAF) to prevent unauthenticated enumeration attempts.

Hi! I’m here to help you understand CVE-2026-82043. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70