CVE-2026-81033

Name of the Vulnerable Software and Affected Versions Automatisch (affected versions not specified)

Description An information disclosure issue exists in the forgot-password functionality. The endpoint '/api/v1/users/forgot-password' allows an unauthenticated user to determine if a specific address is registered. This occurs because the controller in packages/backend/src/controllers/internal/api/v1/users/forgot-password.js returns a not-found status when an address has no account, whereas a registered address triggers a reset message and returns a no-content status. Due to the lack of authentication and rate limiting, an attacker can submit multiple candidate addresses and compare the response status codes to identify registered accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.