CVE-2026-82043
UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
UTMStack UTMStack
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 11.2.16UTMStackCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.
Text from CVE List
Affected versions 1
- UTMStackaffected: all versions before 11.2.16CVE List