Automatisch EUVD-2026-66609

No special conditions are required - the /api/v1/users/forgot-password route is mounted without authentication middleware, so any caller with HTTP network access to the Automatisch instance can exploit the discrepancy against its default configuration. No application feature flag, non-default setting, or elevated privilege is needed. Exploitation is bounded in impact to account existence disclosure only: no passwords, session tokens, or user data are exposed through this endpoint. Bulk enumeration is further uninhibited by the absence of rate limiting in the described code path. The only practical limiting factor is network reachability to the Automatisch instance; deployments restricted to internal networks or VPNs reduce the attack surface to internal or VPN-authenticated parties.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9) accurately characterizes this as a remotely exploitable, zero-prerequisite flaw with limited but real confidentiality impact. The practical risk is primarily as an enabler for downstream attacks: bulk enumeration of confirmed account holders raises the efficiency of credential-stuffing and spear-phishing operations against Automatisch deployments. The absence of rate limiting in the code path means automated enumeration of large address lists is unrestricted, which amplifies the exploitation surface beyond what the modest CVSS score alone suggests. No EPSS data was provided, no public exploit code is referenced, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. The real-world risk is therefore moderate - meaningful for organizations whose Automatisch user base represents sensitive or high-value targets, but not an immediate breach vector on its own.

An attacker obtains a list of candidate email addresses for an organization from public sources such as LinkedIn exports or previous data breach dumps, then scripts HTTP POST requests to the Automatisch instance's /api/v1/users/forgot-password endpoint for each address. By sorting responses into HTTP 204 (account exists) and HTTP 404 (no account) buckets, the attacker builds a verified list of active Automatisch users in minutes with no credentials and no observable rate-limit enforcement, and then uses those confirmed addresses as targets for spear-phishing or as inputs to credential-stuffing tools.