CVE-2026-44679CWE-770

Tuist: Forgot password flow lacks throttling for reset email delivery

Medium · published May 14, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account without server-side throttling. In self-hosted deployments, this can be abused to send large volumes of unwanted email and consume downstream email delivery resources. This vulnerability is fixed in 1.180.10.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-05-14T20:40Z
EPSS history
Timeline
  • 14 MAY 20:40Z
    Tuist: Forgot password flow lacks throttling for reset email delivery
    cvelistv5