CVE-2020-10102

CVE-2020-10102 describes an information disclosure vulnerability in Zammad versions 3.0 through 3.2, specifically within its "Forgot Password" functionality. An attacker can leverage differing application responses to determine valid user email addresses, enabling a two-stage attack to identify valid accounts for subsequent brute-force attempts. Rated as MEDIUM severity (CVSS 5.3), this vulnerability has a network attack vector and high confidentiality impact, but requires high attack complexity. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.