Agentis CVE-2026-100164

Exploitation requires network reachability to an Agentis instance (version before 4.8) exposing an authentication or account-handling function whose responses differ for valid versus invalid accounts; per the CVSS vector it needs no authentication (PR:N) and no user interaction (UI:N). The available sources do not name the exact feature, endpoint, or parameter that produces the observable discrepancy, so the precise trigger is not described. Limiting factors: impact is confined to disclosure of account existence (no integrity/availability effect), value is realized only as a precursor to follow-on attacks (credential stuffing, phishing), and exposure depends on the Agentis instance being internet-reachable; the flaw is fully remediated by upgrading to version 4.8.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity, unauthenticated information-disclosure flaw with no integrity or availability impact. However, the C:H rating is difficult to reconcile with the stated impact: CWE-204 (observable response discrepancy) enabling 'Account Footprinting' is account/username enumeration, which typically exposes only the existence of accounts rather than high-value confidential data - so the HIGH confidentiality rating appears inflated relative to the described mechanism (see assessed_cvss_vector for an independent C:L assessment). No EPSS score, SSVC exploitation/automatable/technical-impact values, KEV entry, or PoC reference was supplied. The vuln.today decision label is 'this_week' (not act_now or emergency), and there is no public exploit identified at time of analysis, which is consistent with a flaw that is real but not under known active exploitation. Net: this is a genuine but lower-tier priority - the enumeration primitive aids credential-stuffing and targeted phishing against a niche product rather than constituting a direct compromise. A patch (version 4.8) is available from the vendor, so remediation is straightforward and the right near-term action.

A remote, unauthenticated attacker sends authentication or account-related requests (e.g. login, password-reset, or registration) to an Agentis instance and compares the responses - differences in message text, status, or timing reveal which usernames or email addresses correspond to valid accounts. The attacker uses the resulting list of confirmed accounts to prime credential-stuffing or targeted phishing. No public exploit was identified at time of analysis; the exact request/response difference that triggers the discrepancy is not described in the available sources.