UTMStack up to 11.2.15 init information disclosure

Summaryinfo

A vulnerability was found in UTMStack up to 11.2.15 and classified as problematic. This affects an unknown part of the file /api/account/reset-password/init. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-82043. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in UTMStack up to 11.2.15. Affected by this issue is an unknown code of the file /api/account/reset-password/init. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and distinguish registered accounts, which return 200 OK, from unregistered accounts, which trigger a 500 Internal Server Error with backend error details, enabling targeted phishing or credential attacks.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-82043 since 08/27/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 11.2.16 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• UTMStack

Version

• 11.2.0
• 11.2.1
• 11.2.2
• 11.2.3
• 11.2.4
• 11.2.5
• 11.2.6
• 11.2.7
• 11.2.8
• 11.2.9
• 11.2.10
• 11.2.11
• 11.2.12
• 11.2.13
• 11.2.14
• 11.2.15

Website

• Product: https://github.com/UTMStack/UTMStack/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion