CVE-2026-19965

automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

State: Published
Severity: 6.3 Medium
Published: Aug 17, 2026
Updated: Aug 19, 2026
Reserved: Aug 16, 2026

Description

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-204 Observable Response Discrepancy
CWE-203 Information Exposure Through Discrepancy

Affected Products

Product	Versions
automadn/a	2.0.0-beta.0Affected 2.0.0-beta.1Affected 2.0.0-beta.2Affected 2.0.0-beta.3Affected 2.0.0-beta.4Affected 2.0.0-beta.5Affected 2.0.0-beta.6Affected 2.0.0-beta.7Affected 2.0.0-beta.8Affected 2.0.0-beta.9Affected 2.0.0-beta.10Affected 2.0.0-beta.11Affected 2.0.0-beta.12Affected 2.0.0-beta.13Affected 2.0.0-beta.14Affected 2.0.0-beta.15Affected 2.0.0-beta.16Affected 2.0.0-beta.17Affected 2.0.0-beta.18Affected 2.0.0-beta.19Affected 2.0.0-beta.20Affected 2.0.0-beta.21Affected 2.0.0-beta.22Affected 2.0.0-beta.23Affected 2.0.0-beta.24Affected and 9 more versions

Product

Versions

automadn/a

2.0.0-beta.0Affected
2.0.0-beta.1Affected
2.0.0-beta.2Affected
2.0.0-beta.3Affected
2.0.0-beta.4Affected
2.0.0-beta.5Affected
2.0.0-beta.6Affected
2.0.0-beta.7Affected
2.0.0-beta.8Affected
2.0.0-beta.9Affected
2.0.0-beta.10Affected
2.0.0-beta.11Affected
2.0.0-beta.12Affected
2.0.0-beta.13Affected
2.0.0-beta.14Affected
2.0.0-beta.15Affected
2.0.0-beta.16Affected
2.0.0-beta.17Affected
2.0.0-beta.18Affected
2.0.0-beta.19Affected
2.0.0-beta.20Affected
2.0.0-beta.21Affected
2.0.0-beta.22Affected
2.0.0-beta.23Affected
2.0.0-beta.24Affected
and 9 more versions

References

VDB-391142 | automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancyvdb-entrytechnical-description
VDB-391142 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-19965 | CVE Analysis and Reportthird-party-advisory
Submit #873022 | Automad Automad CMS 2.0.0 Information Disclosurethird-party-advisory
https://github.com/marcantondahmen/automad/issues/191exploitissue-tracking
https://github.com/marcantondahmen/automad/commit/eac0b05dafdb0ddf8b9139dad8929aaba86568capatch
https://github.com/marcantondahmen/automad/releases/tag/2.0.0-beta.33patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.