CVE-2026-82043

MediumCVSS 5.3/10Last modified Oct 6, 2026

Description

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-820447.7UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request CVE-2026-820456.5UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploitCVE-2026-820498.4In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link CVE-2026-82055.3Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on tCVE-2026-820526.5The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod)CVE-2026-820538.1A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identitiesCVE-2026-820546.5A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includeCVE-2026-820556.5A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a sCVE-2026-820565.3A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under cCVE-2026-820576.5A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By sCVE-2026-820586.5A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod CVE-2026-820596.5An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being re