CVE-2026-82043: falha de média gravidade em UTMStack
UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.2%
probabilidade de exploração
0.2%top 85% das CVEs
exploração observada
nãonenhuma fonte reporta
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
UTMStack · UTMStackCVEs relacionadas — UTMStack
No mesmo produto, das mais perigosas para as menos.
CVE-2026-82042CRITICALUTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilterEPSS 0.5%CVE-2026-82041MEDIUMUTMStack < 11.2.16 Missing Authorization via Command WebSocketEPSS 0.4%CVE-2026-82039HIGHUTMStack < 11.2.16 SQL Injection via searchGroupsByFilterEPSS 0.3%CVE-2026-82045HIGHUTMStack < 11.2.16 JPQL Injection via searchPropertyValuesEPSS 0.3%CVE-2026-82044MEDIUMUTMStack < 11.2.16 Server-Side Request Forgery via downloadPdfEPSS 0.3%CVE-2026-82040MEDIUMUTMStack < 11.2.16 SSRF via IdentityProviderServiceEPSS 0.2%