User Enumeration Vulnerability in Automatisch by Automatisch

CVE-2026-81033

What is CVE-2026-81033?

The vulnerability in Automatisch allows an attacker to determine whether an email address is registered in the system through the password reset feature. When a user attempts to reset their password, the system differentiates between registered and unregistered addresses based on the error responses it generates. Specifically, registered addresses trigger a reset email, whereas unregistered addresses yield a not-found status. Because the request path lacks authentication and rate limiting, an attacker can send multiple requests to probe various email addresses, thus revealing registered accounts without needing valid credentials.

References