Username enumeration via differentiated password-reset responses

Observable response discrepancy in Pimcore before 10.1.3 allows remote attackers to enumerate usernames through lost-password requests. The lostpasswordAction passes account-specific errors to lostpassword.html.twig, which displays them instead of the same success notice for every submitted username. Unauthenticated network access to the admin password-reset form is sufficient; the consequence is disclosure of which usernames exist.