UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.
CVE-2026-82043
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-82043
UTMStack
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/utmstack/UTMStack",
"vendor": "UTMStack",
"product": "UTMStack",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "11.2.16",
"versionType": "semver"
}
],
"packageURL": "pkg:github/utmstack/UTMStack",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-82043
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #9404 · Revision 1
- Added to Heist Feed
- Publisher date