UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses… (CVE-2026-82043)
UTMStack versions prior to 11.2.16 have an account enumeration vulnerability. This flaw allows unauthenticated attackers to determine if an email address is registered by submitting it to the password reset initiation endpoint. Registered emails return a 200 OK response, while unregistered ones cause a 500 Internal Server Error with backend details. This behavior enables attackers to distinguish valid accounts, potentially facilitating targeted phishing or credential attacks.
AI Analysis
Technical Summary
UTMStack before version 11.2.16 is vulnerable to account enumeration via the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts from unregistered ones based on differing HTTP responses: 200 OK for registered emails and 500 Internal Server Error for unregistered emails with backend error details. This vulnerability enables attackers to confirm valid user accounts without authentication.
Potential Impact
The vulnerability allows attackers to confirm the existence of user accounts by observing server responses, which can be leveraged to conduct targeted phishing campaigns or credential stuffing attacks. There is no direct impact on confidentiality, integrity, or availability beyond the information disclosure of registered email addresses.
Mitigation Recommendations
Upgrade UTMStack to version 11.2.16 or later where this vulnerability is fixed. If upgrading is not immediately possible, consider implementing rate limiting or generic error responses on the password reset endpoint to prevent account enumeration. Patch status is not explicitly confirmed in the input, but the version 11.2.16 is indicated as the fixed version.
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses… (CVE-2026-82043)
Description
UTMStack versions prior to 11.2.16 have an account enumeration vulnerability. This flaw allows unauthenticated attackers to determine if an email address is registered by submitting it to the password reset initiation endpoint. Registered emails return a 200 OK response, while unregistered ones cause a 500 Internal Server Error with backend details. This behavior enables attackers to distinguish valid accounts, potentially facilitating targeted phishing or credential attacks.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/utmstack/UTMStackRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
UTMStack before version 11.2.16 is vulnerable to account enumeration via the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts from unregistered ones based on differing HTTP responses: 200 OK for registered emails and 500 Internal Server Error for unregistered emails with backend error details. This vulnerability enables attackers to confirm valid user accounts without authentication.
Potential Impact
The vulnerability allows attackers to confirm the existence of user accounts by observing server responses, which can be leveraged to conduct targeted phishing campaigns or credential stuffing attacks. There is no direct impact on confidentiality, integrity, or availability beyond the information disclosure of registered email addresses.
Mitigation Recommendations
Upgrade UTMStack to version 11.2.16 or later where this vulnerability is fixed. If upgrading is not immediately possible, consider implementing rate limiting or generic error responses on the password reset endpoint to prevent account enumeration. Patch status is not explicitly confirmed in the input, but the version 11.2.16 is indicated as the fixed version.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-62x9-x97p-5mj3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-82043"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ac139baa43b0b3b89d69d3c
Added to database: 10/03/2026, 17:22:02 UTC
Last enriched: 10/03/2026, 17:42:24 UTC
Last updated: 10/03/2026, 22:35:35 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.