Affected by a flaw in Automad’s Password Reset Endpoint, the requestPasswordResetToken function in UserController.php allows an attacker to manipulate the name-or-email argument and observe differing responses. This behavior reveals whether a supplied user identifier exists, enabling user enumeration. The weakness is categorized under CWE‑203 and CWE‑204, indicating information disclosure through traffic analysis and potential side‑channel leaks. The attack can be launched from a remote host and requires high effort, but is considered difficult to exploit in practice.

The vulnerability impacts Automad installations running any version up to and including 2.0.0‑beta.32. The affected product is the Automad CMS platform, with the issue located in the server API controller handling password reset requests. Updating to version 2.0.0‑beta.33, which includes the patch commit eac0b05dafdb0ddf8b9139dad8929aaba86568ca, removes the response discrepancy.

With a CVSS score of 6.3, this vulnerability presents a moderate severity risk. There is no EPSS score available, and it has not been listed in CISA’s KEV catalog, suggesting limited current exploitation. Nonetheless, the remote nature of the attack and the ability to enumerate user accounts could be leveraged in targeted phishing or credential‑guessing campaigns. Because the exploitability is judged difficult, the likelihood of an active attack remains lower, but organizations should still prioritize remediation to avoid potential privacy breaches.