Vulnerability Description
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/marcantondahmen/automad/commit/eac0b05dafdb0ddf8b9139dad8929a
- https://github.com/marcantondahmen/automad/issues/191
- https://github.com/marcantondahmen/automad/releases/tag/2.0.0-beta.33
- https://vuldb.com/cve/CVE-2026-19965
- https://vuldb.com/submit/873022
- https://vuldb.com/vuln/391142
- https://vuldb.com/vuln/391142/cti
- https://vuldb.com/submit/873022
FAQ
What is CVE-2026-19965?
CVE-2026-19965 is a vulnerability with a CVSS score of 3.7 (LOW). A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of th...
How severe is CVE-2026-19965?
CVE-2026-19965 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-19965?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.