Automatisch
Monthly
User enumeration via observable response discrepancy in Automatisch through v0.15.0 allows any unauthenticated remote caller to determine whether an email address holds an account. The forgot-password endpoint returns HTTP 404 for unregistered addresses and HTTP 204 for registered ones, with no rate limiting on the route, making automated bulk enumeration of account holders trivially achievable. No public exploit code or CISA KEV listing has been identified, though the zero-barrier exploitation conditions (unauthenticated, network-reachable, low complexity) make this a practical reconnaissance primitive for targeted phishing or credential-stuffing campaigns.
Server-side request forgery in Automatisch through commit 41f3c56 exposes internal network services to any authenticated user holding the 'manage Flow' permission. The HTTP Request app's Custom Request action passes caller-supplied URLs directly to the backend HTTP client with no allowlist, blocklist, or redirect controls, enabling full response-body retrieval from cloud metadata endpoints, internal APIs, and private network hosts. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-changed, high-confidentiality CVSS vector reflects the severity of lateral access achievable through this single permission.
User enumeration via observable response discrepancy in Automatisch through v0.15.0 allows any unauthenticated remote caller to determine whether an email address holds an account. The forgot-password endpoint returns HTTP 404 for unregistered addresses and HTTP 204 for registered ones, with no rate limiting on the route, making automated bulk enumeration of account holders trivially achievable. No public exploit code or CISA KEV listing has been identified, though the zero-barrier exploitation conditions (unauthenticated, network-reachable, low complexity) make this a practical reconnaissance primitive for targeted phishing or credential-stuffing campaigns.
Server-side request forgery in Automatisch through commit 41f3c56 exposes internal network services to any authenticated user holding the 'manage Flow' permission. The HTTP Request app's Custom Request action passes caller-supplied URLs directly to the backend HTTP client with no allowlist, blocklist, or redirect controls, enabling full response-body retrieval from cloud metadata endpoints, internal APIs, and private network hosts. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-changed, high-confidentiality CVSS vector reflects the severity of lateral access achievable through this single permission.