1 files changed, 10 insertions, 1 deletions
diff --git a/routes/users.ts b/routes/users.ts
index 3bf41355..572224be 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -759,7 +759,16 @@ export default {
       let id;
       let user;
 
-      if (u.username !== config.admin) fail("disabled");
+      // Non-admins must not be able to tell this admin-only endpoint exists.
+      // Log the probe (so exploit-watch can flag it) but return a generic 404
+      // identical to an unregistered route — previously it returned "disabled",
+      // which confirmed the endpoint AND its admin-gating to attackers.
+      if (u?.username !== config.admin) {
+        err("password reset failed disabled", req.headers["cf-connecting-ip"]);
+        return res
+          .code(404)
+          .send({ message: "Route POST:/reset not found", error: "Not Found", statusCode: 404 });
+      }
       id = await g(`user:${username.toLowerCase().replace(/\s/g, "")}`);
       user = await g(`user:${id}`);