EUVD-2026-60010
GHSA-h782-f8rf-prx2
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint; AC:H consistent with vendor rating and difficult exploitability; impact limited to low confidentiality via account enumeration only.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.
AnalysisAI
User enumeration via observable response discrepancy in automad's password reset endpoint (versions up to 2.0.0-beta.32) allows unauthenticated remote attackers to determine whether a given username or email address is registered. The requestPasswordResetToken function in UserController.php previously returned a distinct error (userNotFoundError) for non-existent accounts while returning a success response for valid ones, enabling systematic account enumeration. No active exploitation is confirmed by CISA KEV, though the exploit technique has been publicly disclosed per the VulDB submission.
Technical ContextAI
Automad is a flat-file PHP CMS. The vulnerability resides in automad/src/server/Controllers/API/UserController.php within the requestPasswordResetToken() static method. The root cause is CWE-203 (Observable Response Discrepancy): the API returned differentiated responses based on whether the name-or-email POST parameter matched an existing account. The commit diff confirms that the pre-fix code path explicitly returned Text::get('userNotFoundError') for unknown users, while valid users triggered token generation and a success email - two observable, distinct outcomes. The fix (commit eac0b05) short-circuits the condition to !$User || $User->sendPasswordResetToken(...), unifying both paths into a single success response, and updates the UI string in english.json to read 'If the provided username or email matches an account...' - the canonical fix pattern for CWE-203 in account recovery flows.
RemediationAI
Upgrade automad to version 2.0.0-beta.33 or later, which eliminates the response discrepancy by returning a uniform success message regardless of whether the submitted identifier matches a registered account. The patched release is available at https://github.com/marcantondahmen/automad/releases/tag/2.0.0-beta.33, with the specific fix in commit eac0b05dafdb0ddf8b9139dad8929aaba86568ca. If an immediate upgrade is not feasible, a compensating control is to place the password reset endpoint behind network access controls (e.g., IP allowlist or VPN requirement) to limit who can send enumeration requests - note this restricts legitimate password recovery for users outside that network. Rate limiting on the endpoint reduces enumeration throughput but does not eliminate the information leak. Response-time normalization (ensuring both paths take equal time) would also reduce but not eliminate the discrepancy, since the current fix addresses the response body difference, not timing.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today