The Pterodactyl panel contains a user enumeration vulnerability (CWE-204) in its account email update POST endpoint. Unlike login and password reset forms, this endpoint does not implement reCAPTCHA or rate limiting, allowing authenticated users to automate requests to verify if specific email addresses exist in the system. Attackers can capture and modify email update requests to test arbitrary addresses repeatedly without restriction, enabling large-scale enumeration of registered users. This vulnerability affects all versions prior to 1.12.3.

Attackers with any valid account can enumerate registered email addresses on the Pterodactyl panel. This compromises user privacy and enables attackers to compile comprehensive user lists, which can be leveraged for targeted phishing, social engineering, credential stuffing, and competitive intelligence. The vulnerability particularly risks high-value accounts such as administrators. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the email update endpoint to trusted users only and monitor for unusual activity. Implementing external rate limiting or CAPTCHA protections at the web server or application firewall level may help mitigate automated enumeration attempts.