A flaw in the password reset process of UTMStack allows unauthenticated users to discover whether an email address is associated with an account by observing the HTTP status code returned by the /api/account/reset-password/init endpoint. Registered emails elicit a 200 OK response, while unregistered emails trigger a 500 Internal Server Error that exposes backend error details. This can be abused by adversaries to build a list of valid victim accounts and launch tailored credential or phishing campaigns. The weakness is defined as CWE‑204, which categorizes information disclosure through differences in system responses.

UTMStack products running any version earlier than 11.2.16 are affected. The issue exists in all releases before that version and is not present in 11.2.16 and newer.

The CVSS score of 6.9 indicates a moderate impact with confidentiality concerns. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known public exploits yet. Attackers can exploit the flaw remotely over the network by sending HTTP POST requests to the password reset endpoint without authentication, making it easily reachable from an external network. The primary threat is the collection of valid email addresses for subsequent phishing or credential stuffing attempts.