CVE-2026-71213

Kritik

Teknik Veri (Otomatik)

CVSS Skoru: 9.1
EPSS: 0.3%
CWE: CWE-307
KEV Durumu: Hayır

Yayım tarihi: 5 Ağustos 2026

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.

Referanslar

https://github.com/typemill/typemill

NVD kaydı ↗CVE.org ↗

Bu CVE için henüz editoryal inceleme yapılmadı. Sadece otomatik teknik veri gösteriliyor.