Skip to main content

Automatisch CVE-2026-81033

| EUVDEUVD-2026-66609 MEDIUM
Observable Response Discrepancy (CWE-204)
2026-08-26 VulnCheck GHSA-p996-89cm-88c6
Information Disclosure Automatisch
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Unauthenticated network route with no complexity barrier; confidentiality impact limited to account existence disclosure only, no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 26, 2026 - 16:57 vuln.today

DescriptionCVE.org

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.

AnalysisAI

User enumeration via observable response discrepancy in Automatisch through v0.15.0 allows any unauthenticated remote caller to determine whether an email address holds an account. The forgot-password endpoint returns HTTP 404 for unregistered addresses and HTTP 204 for registered ones, with no rate limiting on the route, making automated bulk enumeration of account holders trivially achievable. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Collect candidate email addresses from OSINT
Delivery
Send unauthenticated POST to /forgot-password for each address
Exploit
Compare HTTP 404 (no account) vs HTTP 204 (registered) responses
Execution
Compile confirmed account list
Impact
Target confirmed users with credential-stuffing or phishing
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required - the /api/v1/users/forgot-password route is mounted without authentication middleware, so any caller with HTTP network access to the Automatisch instance can exploit the discrepancy against its default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9) accurately characterizes this as a remotely exploitable, zero-prerequisite flaw with limited but real confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker obtains a list of candidate email addresses for an organization from public sources such as LinkedIn exports or previous data breach dumps, then scripts HTTP POST requests to the Automatisch instance's /api/v1/users/forgot-password endpoint for each address. By sorting responses into HTTP 204 (account exists) and HTTP 404 (no account) buckets, the attacker builds a verified list of active Automatisch users in minutes with no credentials and no observable rate-limit enforcement, and then uses those confirmed addresses as targets for spear-phishing or as inputs to credential-stuffing tools.
Remediation The authoritative fix is to update the forgot-password controller to return an identical HTTP status code regardless of whether the submitted email address corresponds to a registered account - typically returning 200 or 204 unconditionally while still dispatching the reset email only when an account exists. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Automatisch

View all
CVE-2026-72566 HIGH
7.7 Aug 10

Server-side request forgery in Automatisch through commit 41f3c56 exposes internal network services to any authenticated

Same weakness CWE-204 – Observable Response Discrepancy

View all
CVE-2018-25350 CRITICAL POC
9.3
CVE-2024-28232 HIGH POC
7.5
CVE-2024-24766 HIGH POC
7.5
CVE-2026-54768 MEDIUM POC
6.9
CVE-2025-66307 MEDIUM POC
6.5
CVE-2024-6056 MEDIUM POC
6.3
CVE-2025-30150 MEDIUM POC
5.5
CVE-2024-55198 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-81033 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy