The vulnerability allows an unauthenticated attacker to determine whether a given email address is registered in Automatisch by observing the differing HTTP status codes returned from the forgot‑password endpoint. When an address is not found the backend throws a NotFound exception, which the global handler translates into a 404 response, whereas a registered address triggers a password reset email and receives a 204 No Content response. By submitting many candidate addresses and comparing the status codes, an attacker can enumerate active accounts without credentials or rate limiting.

Automatisch, the open‑source workflow automation platform, is impacted in its 0.15.0 release. The forgot‑password route is mounted without authentication, enabling the enumeration. No other product versions are explicitly stated as affected; the issue appears tied to the 0.15.0 code that contains the faulting controller.

The CVSS score of 6.9 reflects a moderate severity, with no EPSS score available and the vulnerability not listed in the CISA KEV catalog. The attack vector is unauthenticated HTTP request to a public endpoint; because the system enforces no rate limiting, enumeration is straightforward. In practice, attackers could use automated scripts to harvest all registered email addresses, compromising privacy and potentially enabling further phishing or credential‑reuse attacks.