Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-81033 Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/… https://www.cve.org/CVERecord?id=CVE-2026-81033
Post summary
CVE‑2026‑81033 discloses that the forgot‑password endpoint leaks whether an address is registered, constituting an information‑disclosure flaw.
🚨*CVE* CVE-2026-81033 Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/… https://www.cve.org/CVERecord?id=CVE-2026-81033 ----- Traducción: CVEs-2026-81033 Au… https://infoflow.cloud`
Post summary
CVE-2026-81033 allows attackers to determine if an email address is registered via the forgot-password response, constituting an information disclosure vulnerability.
CVE-2026-81033 Information Disclosure in Automatisch Forgot Password Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-81033
Post summary
The text announces CVE-2026-81033, describing it as an information disclosure issue in the Automatisch forgot‑password endpoint, but provides no PoC, exploit, active exploitation, patch, or debunking information.