Executive brief
Automatisch is an open-source workflow automation platform. The forgot-password feature reveals whether an email address is registered by returning different HTTP status codes for valid vs. invalid accounts, allowing attackers to enumerate user accounts without authentication or rate limiting.
Technical details
The vulnerability is user enumeration (information disclosure) in the forgot-password endpoint at /packages/backend/src/controllers/internal/api/v1/users/forgot-password.js. The controller performs an unauthenticated email lookup and chains a throwIfNotFound() error handler: if the email is not registered, a 404 error is rendered; if registered, a reset email is sent and a 204 No Content response is returned. An attacker can submit candidate email addresses and differentiate registered from unregistered accounts by observing the HTTP status code, with no authentication required and no rate limiting in place. The route lacks both input validation safeguards and timing-attack mitigation.
Affected products
- Automatisch Automatisch up to v0.15.0
Timeline
- 2026-08-26: disclosed