EUVD-2026-91798
GHSA-62x9-x97p-5mj3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public reset-password endpoint
-
ExploitSubmit candidate email addresses
-
ExecutionDistinguish 200 vs 500 responses
-
ImpactBuild validated account list for phishing
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Response uniformity
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of UTMStack, provided the web interface and the POST /api/account/reset-password/init endpoint are network-reachable. The underlying prerequisite is simply that password reset is enabled (standard in default deployments). Limiting factors: the vulnerability only discloses whether an email is a registered account (no credentials, data, or code execution), the 500-vs-200 oracle could be partially masked by rate limiting or a WAF in front of the application, and exploitation depends on the attacker already possessing or guessing candidate email addresses to test. |
| Impact | This is a medium-severity information-disclosure issue (CWE-204, observable response discrepancy) rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity access with no special attack requirements, so the flaw is trivially reachable - but impact is limited to VC:L (confidentiality low) with no integrity or availability effect, which is why the score sits at 6.9. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the low intrinsic impact also makes mass exploitation unlikely to be prioritized by attackers on its own. The realistic danger is as a reconnaissance primitive feeding targeted phishing or credential-stuffing, not as a standalone breach vector. One caveat: the GitHub 'source code evidence' commit diff provided describes CVE-2026-82042 (an internal API-key filter hardening), NOT the account-enumeration fix, so the patch code for THIS CVE is not independently visible in the supplied data - verify the actual fix against the vendor advisory. |
| Exploit ScenarioDerived | An unauthenticated attacker scripts repeated POST requests to /api/account/reset-password/init with a list of candidate email addresses and records which return 200 OK (registered) versus 500 Internal Server Error (unregistered). The attacker thereby compiles a validated list of real UTMStack user accounts and feeds it into targeted spear-phishing or password-spraying campaigns. No public exploit was identified at time of analysis, but the technique is simple enough to automate with a basic HTTP script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Account enumeration in UTMStack before 11.2.16 lets unauthenticated remote attackers submit arbitrary email addresses to POST /api/account/reset-password/init and learn which ones are registered, because known accounts return HTTP 200 while unknown accounts return HTTP 500 with backend error details. The exposure is limited to confirming account existence - no credentials, session data, or code execution are obtained - making this a medium-severity information-disclosure issue (CWE-204) consistent with the independent assessment vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which requires only that the web interface and the reset endpoint be network-reachable on a default deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis; VulnCheck reported the issue and a vendor-released fix is available as v11.2.16, with the practical risk being follow-on targeted phishing or credential attacks that leverage a confirmed mailbox list.
RemediationAI
Vendor-released patch: upgrade to UTMStack v11.2.16 or later, which is the fixed version identified in the release reference https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16 (details in the VulnCheck advisory https://www.vulncheck.com/advisories/utmstack-account-enumeration-via-password-reset-endpoint). Where immediate upgrade is not possible, treat the reset endpoint as untrusted until it is patched: place rate limiting or a WAF rule in front of POST /api/account/reset-password/init to blunt automated enumeration, accepting that this only slows and partially masks the 200-vs-500 oracle rather than eliminating it; or restrict network reachability of the endpoint (reverse-proxy ACL, VPN-only access, or IP allowlisting) so only expected user populations can reach it, with the trade-off that external self-service password resets become unavailable. Detection-side, monitor for bursts of reset requests from a single source or a high ratio of 500 responses to that endpoint, as these indicate scan-style enumeration. Independently, because the underlying risk is follow-on phishing and credential attacks against confirmed accounts, enforce multi-factor authentication and user awareness for all UTMStack accounts, since account-existence disclosure alone does not grant access. No compensating control fully removes the information leak short of the vendor fix, as the discrepancy is generated by the application's own error handling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UTMStack is a SIEM/log-management platform whose backend is a Java Spring Boot application, as shown by the patch path backend/src/main/java/com/park/utmstack/. The vulnerability class is CWE-204 (observable response discrepancy): the password-reset initiation controller handles the registered-email path normally and returns 200 OK, while the unregistered-email path triggers an unhandled exception that surfaces as HTTP 500 with backend error details. Because the two branches are distinguishable without authentication, the endpoint becomes a functional oracle for mailbox existence rather than a generic reset flow. The CPE entry cpe:2.3:a:utmstack:utmstack:*:*:*:*:*:*:*:* uses a wildcard version, indicating the enumeration behaviour is present across releases prior to the fixed build rather than in one narrowly scoped version. Note that the public commit cited as the patch (4e7a727c) modifies InternalApiKeyFilter.java and explicitly references a sibling issue, CVE-2026-82042, restricting the shared Utm-Internal-Key header to an allowlist of internal routes with constant-time comparison and optional CIDR restriction; the v11.2.16 release notes themselves list only alert-quality and noise-reduction changes and do not itemize the reset-password fix, so the authoritative remediation marker for CVE-2026-82043 is the version bump to v11.2.16 rather than a discrete documented code change in the provided evidence.
Know when Utmstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Endpoint is remotely reachable and unauthenticated with no user interaction (AV:N/AC:L/PR:N/UI:N); only account-existence data leaks, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
UTMStack deployments running versions before 11.2.16 can be fully taken over through an authentication bypass in the Int
Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL
Authenticated JPQL injection in UTMStack SIEM deployments before 11.2.16 lets any holder of a low-privilege account read
Missing authorization in UTMStack before 11.2.16 allows any authenticated user, regardless of role, to execute arbitrary
Server-side request forgery in UTMStack before 11.2.16 lets any authenticated user (even a low-privilege one) coerce the
Server-side request forgery (SSRF) in UTMStack before 11.2.16 is a genuine but moderate-severity issue rather than a top
Exploit-DB