« Volver al listado

CVE-2026-19965

Estado: AplazadaBaja (2.9)—

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Automad — AutomadAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-19965",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-19965",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-19T14:46:43.750226Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:automad:automad:*:*:*:*:*:*:*:*"
          ],
          "vendor": "n/a",
          "modules": [
            "Password Reset Endpoint"
          ],
          "product": "automad",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0-beta.0"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.1"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.2"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.3"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.4"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.5"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.6"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.7"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.8"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.9"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.10"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.11"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.12"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.13"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.14"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.15"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.16"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.17"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.18"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.19"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.20"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.21"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.22"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.23"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.24"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.25"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.26"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.27"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.28"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.29"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.30"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.31"
            },
            {
              "status": "affected",
              "version": "2.0.0-beta.32"
            },
            {
              "status": "unaffected",
              "version": "2.0.0-beta.33"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-17T00:16:27.450",
  "references": [
    {
      "url": "https://github.com/marcantondahmen/automad/commit/eac0b05dafdb0ddf8b9139dad8929aaba86568ca",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/marcantondahmen/automad/issues/191",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/marcantondahmen/automad/releases/tag/2.0.0-beta.33",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-19965",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/873022",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/391142",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/391142/cti",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/873022",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-203"
        },
        {
          "lang": "en",
          "value": "CWE-204"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component."
    }
  ],
  "lastModified": "2026-08-20T12:48:31.843",
  "sourceIdentifier": "cna@vuldb.com"
}