CVE-2026-82043CWE-204

CVE-2026-82043

Medium · published October 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-10-03T01:16Z
References (3)
https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16 · [email protected]https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd · [email protected]https://www.vulncheck.com/advisories/utmstack-account-enumeration-via-password-reset-endpoint · [email protected]
EPSS history
Timeline
  • 04 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 02 OCT 20:17Z
    UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
    cvelistv5