3.7
CVE-2026-19965
- EPSS 0.4%
- Veröffentlicht 17.08.2026 00:16:27
- Zuletzt bearbeitet 20.08.2026 12:48:31
- CVE-Watchlists
- Unerledigt
automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellern/a
≫
Produkt
automad
Version
2.0.0-beta.0
Status
affected
Version
2.0.0-beta.1
Status
affected
Version
2.0.0-beta.2
Status
affected
Version
2.0.0-beta.3
Status
affected
Version
2.0.0-beta.4
Status
affected
Version
2.0.0-beta.5
Status
affected
Version
2.0.0-beta.6
Status
affected
Version
2.0.0-beta.7
Status
affected
Version
2.0.0-beta.8
Status
affected
Version
2.0.0-beta.9
Status
affected
Version
2.0.0-beta.10
Status
affected
Version
2.0.0-beta.11
Status
affected
Version
2.0.0-beta.12
Status
affected
Version
2.0.0-beta.13
Status
affected
Version
2.0.0-beta.14
Status
affected
Version
2.0.0-beta.15
Status
affected
Version
2.0.0-beta.16
Status
affected
Version
2.0.0-beta.17
Status
affected
Version
2.0.0-beta.18
Status
affected
Version
2.0.0-beta.19
Status
affected
Version
2.0.0-beta.20
Status
affected
Version
2.0.0-beta.21
Status
affected
Version
2.0.0-beta.22
Status
affected
Version
2.0.0-beta.23
Status
affected
Version
2.0.0-beta.24
Status
affected
Version
2.0.0-beta.25
Status
affected
Version
2.0.0-beta.26
Status
affected
Version
2.0.0-beta.27
Status
affected
Version
2.0.0-beta.28
Status
affected
Version
2.0.0-beta.29
Status
affected
Version
2.0.0-beta.30
Status
affected
Version
2.0.0-beta.31
Status
affected
Version
2.0.0-beta.32
Status
affected
Version
2.0.0-beta.33
Status
unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.4% | 0.328 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@vuldb.com | 2.9 | 0 | 0 |
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| cna@vuldb.com | 3.7 | 2.2 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| cna@vuldb.com | 2.6 | 4.9 | 2.9 |
AV:N/AC:H/Au:N/C:P/I:N/A:N
|
CWE-203 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
CWE-204 Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
https://github.com/marcantondahmen/automad/commit/eac0b05dafdb0ddf8b9139dad8929aaba86568ca
https://github.com/marcantondahmen/automad/issues/191
https://github.com/marcantondahmen/automad/releases/tag/2.0.0-beta.33
https://vuldb.com/cve/CVE-2026-19965
https://vuldb.com/submit/873022
https://vuldb.com/vuln/391142
https://vuldb.com/vuln/391142/cti