CVE-2026-19965

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19965

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19965.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19965

Published

2026-08-17T00:00:14Z

Modified

2026-08-22T03:31:22Z

Severity

2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

Details

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-203",
        "CWE-204"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19965.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0-beta.0"
                },
                {
                    "last_affected": "2.0.0-beta.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/marcantondahmen/automad

Affected ranges

Type

GIT

Repo

https://github.com/marcantondahmen/automad

Events

Introduced

323dc49a09cfc4851ab617afb7df3a6a7077c0f1

Fixed

eac0b05dafdb0ddf8b9139dad8929aaba86568ca

Fixed

e6c8e1b3bb20c2f1540b0b9451238f4f560c49af

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2.0.0-beta.1"
        },
        {
            "last_affected": "2.0.0-beta.1"
        },
        {
            "introduced": "2.0.0-beta.2"
        },
        {
            "last_affected": "2.0.0-beta.2"
        },
        {
            "introduced": "2.0.0-beta.3"
        },
        {
            "last_affected": "2.0.0-beta.3"
        },
        {
            "introduced": "2.0.0-beta.4"
        },
        {
            "last_affected": "2.0.0-beta.4"
        },
        {
            "introduced": "2.0.0-beta.5"
        },
        {
            "last_affected": "2.0.0-beta.5"
        },
        {
            "introduced": "2.0.0-beta.6"
        },
        {
            "last_affected": "2.0.0-beta.6"
        },
        {
            "introduced": "2.0.0-beta.7"
        },
        {
            "last_affected": "2.0.0-beta.7"
        },
        {
            "introduced": "2.0.0-beta.8"
        },
        {
            "last_affected": "2.0.0-beta.8"
        },
        {
            "introduced": "2.0.0-beta.9"
        },
        {
            "last_affected": "2.0.0-beta.9"
        },
        {
            "introduced": "2.0.0-beta.10"
        },
        {
            "last_affected": "2.0.0-beta.10"
        },
        {
            "introduced": "2.0.0-beta.11"
        },
        {
            "last_affected": "2.0.0-beta.11"
        },
        {
            "introduced": "2.0.0-beta.12"
        },
        {
            "last_affected": "2.0.0-beta.12"
        },
        {
            "introduced": "2.0.0-beta.13"
        },
        {
            "last_affected": "2.0.0-beta.13"
        },
        {
            "introduced": "2.0.0-beta.14"
        },
        {
            "last_affected": "2.0.0-beta.14"
        },
        {
            "introduced": "2.0.0-beta.15"
        },
        {
            "last_affected": "2.0.0-beta.15"
        },
        {
            "introduced": "2.0.0-beta.16"
        },
        {
            "last_affected": "2.0.0-beta.16"
        },
        {
            "introduced": "2.0.0-beta.17"
        },
        {
            "last_affected": "2.0.0-beta.17"
        },
        {
            "introduced": "2.0.0-beta.18"
        },
        {
            "last_affected": "2.0.0-beta.18"
        },
        {
            "introduced": "2.0.0-beta.19"
        },
        {
            "last_affected": "2.0.0-beta.19"
        },
        {
            "introduced": "2.0.0-beta.20"
        },
        {
            "last_affected": "2.0.0-beta.20"
        },
        {
            "introduced": "2.0.0-beta.21"
        },
        {
            "last_affected": "2.0.0-beta.21"
        },
        {
            "introduced": "2.0.0-beta.22"
        },
        {
            "last_affected": "2.0.0-beta.22"
        },
        {
            "introduced": "2.0.0-beta.23"
        },
        {
            "last_affected": "2.0.0-beta.23"
        },
        {
            "introduced": "2.0.0-beta.24"
        },
        {
            "last_affected": "2.0.0-beta.24"
        },
        {
            "introduced": "2.0.0-beta.25"
        },
        {
            "last_affected": "2.0.0-beta.25"
        },
        {
            "introduced": "2.0.0-beta.26"
        },
        {
            "last_affected": "2.0.0-beta.26"
        },
        {
            "introduced": "2.0.0-beta.27"
        },
        {
            "last_affected": "2.0.0-beta.27"
        },
        {
            "introduced": "2.0.0-beta.28"
        },
        {
            "last_affected": "2.0.0-beta.28"
        },
        {
            "introduced": "2.0.0-beta.29"
        },
        {
            "last_affected": "2.0.0-beta.29"
        },
        {
            "introduced": "2.0.0-beta.30"
        },
        {
            "last_affected": "2.0.0-beta.30"
        },
        {
            "introduced": "2.0.0-beta.31"
        },
        {
            "last_affected": "2.0.0-beta.31"
        },
        {
            "introduced": "2.0.0-beta.32"
        },
        {
            "last_affected": "2.0.0-beta.32"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.0.0-beta.1

2.0.0-beta.10

2.0.0-beta.11

2.0.0-beta.12

2.0.0-beta.13

2.0.0-beta.14

2.0.0-beta.15

2.0.0-beta.16

2.0.0-beta.17

2.0.0-beta.18

2.0.0-beta.19

2.0.0-beta.2

2.0.0-beta.20

2.0.0-beta.21

2.0.0-beta.22

2.0.0-beta.23

2.0.0-beta.24

2.0.0-beta.25

2.0.0-beta.26

2.0.0-beta.27

2.0.0-beta.28

2.0.0-beta.29

2.0.0-beta.3

2.0.0-beta.30

2.0.0-beta.31

2.0.0-beta.32

2.0.0-beta.4

2.0.0-beta.5

2.0.0-beta.6

2.0.0-beta.7

2.0.0-beta.8

2.0.0-beta.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19965.json"