CVE-2026-82043

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16

Description An account enumeration issue exists that allows unauthenticated attackers to identify registered email addresses. By sending requests to the 'POST /api/account/reset-password/init' endpoint, attackers can distinguish between registered and unregistered accounts based on the HTTP response. Registered accounts return a 200 OK response, while unregistered accounts trigger a 500 Internal Server Error containing backend details. This information can be used to facilitate targeted phishing or credential attacks.

Recommendations Update to version 11.2.16 or later.