Vulnerabilities CVE-2026-44679

CVE-2026-44679

Medium

Open

TLP:CLEAR

Tuist: Forgot password flow lacks throttling for reset email delivery

NVD CVE.org

Financial Targeting Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account without server-side throttling. In self-hosted deployments, this can be abused to send large volumes of unwanted email and consume downstream email delivery resources. This vulnerability is fixed in 1.180.10.

Details

CVSS Score: 6.9
EPSS Score ⓘ: 0.29%

21.4th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L
Confidence: 90%
Published: May 14, 2026
Last Modified: May 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.