Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-82043UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

Medium 5.3

In plain English

A medium-severity security flaw in UTMStack from UTMStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 83.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.

Affected products (as reported)

Vendor	Product	Versions
UTMStack	UTMStack	0 – before 11.2.16

Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

UTMStack v11.2.16 Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/utmstack-account-enumeration-via-password-reset-endpoint third-party-advisory