by Kastro CVE-2026-129161
dromara free-fs — Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover
Description · from the CVE record
Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.
Affected
ProductAffectedFixed inSource
free-fs2.0.1 – 2.3.1–CNA
Scores by source
VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N