An unprotected user enumeration vulnerability exists in the Pterodactyl panel's account email update endpoint. Authenticated users can test arbitrary email addresses to determine if they are registered, as the endpoint lacks rate limiting and CAPTCHA protections. This allows attackers to enumerate all registered emails, potentially targeting administrators and high-value accounts. The vulnerability affects all Pterodactyl panel installations prior to version 1.12.3.