CVE-2026-81033: Automatisch User Enumeration Vulnerability

CVE-2026-81033 Overview

CVE-2026-81033 is a user enumeration vulnerability in Automatisch, an open-source workflow automation platform. The flaw resides in the unauthenticated forgot-password endpoint, which returns distinct HTTP status codes depending on whether a submitted email address matches a registered account. Attackers can iterate through candidate addresses and compare responses to determine which addresses correspond to valid accounts. The endpoint enforces no authentication and no rate limiting, allowing automated enumeration at scale. The issue is tracked under [CWE-204: Observable Response Discrepancy].

Critical Impact
Unauthenticated attackers can harvest valid account identifiers from an Automatisch instance, providing a foundation for credential stuffing, phishing, and targeted social engineering.

Affected Products

Automatisch through version 0.15.0
Self-hosted Automatisch deployments exposing the internal API
Any instance mounting packages/backend/src/controllers/internal/api/v1/users/forgot-password.js

Discovery Timeline

2026-08-26 - CVE-2026-81033 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-81033

Vulnerability Analysis

The vulnerability exists in the forgot-password controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js. The controller performs a lookup on the submitted email address and chains a not-found error onto the query. When an address has no associated account, the query raises an error that the global handler renders as a not-found status. When an address matches a registered user, the controller proceeds to dispatch a reset message and returns a no-content status.

The route is mounted without authentication and without rate limiting. Because the two response paths produce distinguishable HTTP status codes, attackers can submit candidate addresses and infer account existence from the response alone. This behavior classifies as an observable response discrepancy under [CWE-204].

Root Cause

The root cause is inconsistent response handling in the password-reset flow. A secure implementation returns a uniform response regardless of whether the address exists. Automatisch instead surfaces the database lookup outcome through differentiated status codes, exposing account state to any network-reachable caller.

Attack Vector

An unauthenticated attacker sends a large list of candidate email addresses to the forgot-password endpoint. The attacker records the status code returned for each submission. Addresses returning no-content indicate registered accounts, while addresses returning not-found indicate unregistered addresses. The absence of rate limiting allows enumeration to proceed at machine speed.

The vulnerability mechanism is detailed in the VulnCheck Advisory on User Enumeration and referenced in GitHub Issue #2713.

Detection Methods for CVE-2026-81033

Indicators of Compromise

High volumes of POST requests to the /internal/api/v1/users/forgot-password endpoint from a single source or small IP range
Sequential submissions of email addresses drawn from common wordlists or breach corpora
Mixed response distributions with alternating no-content and not-found status codes to the same client
Absence of subsequent password-reset link consumption despite reset messages being generated

Detection Strategies

Instrument the forgot-password route with request logging that captures source IP, submitted address hash, and response status
Alert when a single source submits more than a small threshold of forgot-password requests within a short window
Correlate forgot-password activity with subsequent authentication attempts to identify enumeration followed by credential stuffing

Monitoring Recommendations

Ingest reverse-proxy and application logs for the /users/forgot-password route into a centralized analytics platform
Build dashboards that track forgot-password request rates, unique source counts, and response-code ratios
Review outbound mail server logs for spikes in password-reset messages that do not correspond to expected user activity

How to Mitigate CVE-2026-81033

Immediate Actions Required

Place the Automatisch instance behind an authenticated proxy or restrict the internal API to trusted networks until a patch is available
Enforce rate limiting on the forgot-password route at the reverse proxy or web application firewall layer
Monitor logs for enumeration patterns and block source IPs demonstrating high-volume forgot-password activity

Patch Information

At the time of publication, the vulnerability is reported against Automatisch through version 0.15.0. Consult the Automatisch GitHub repository and GitHub Issue #2713 for the current status of a fix. Administrators should upgrade to any release that normalizes the forgot-password response and adds rate limiting.

Workarounds

Modify the forgot-password controller to return a uniform no-content response regardless of whether the submitted address is registered
Introduce request throttling on the forgot-password route, keyed by source IP and submitted address
Add a CAPTCHA or equivalent challenge on the password-reset form to prevent automated submissions
Restrict exposure of the internal API endpoints to authenticated administrative networks where feasible

bash

# Example nginx rate-limit configuration for the forgot-password route
limit_req_zone $binary_remote_addr zone=fp_zone:10m rate=5r/m;

location /internal/api/v1/users/forgot-password {
    limit_req zone=fp_zone burst=5 nodelay;
    proxy_pass http://automatisch_backend;
}