CVE-2026-44679

6.9 mediumEPSS 0.3%

Medium (6.9). EPSS 0.3% chance of exploitation in the next 30 days.

Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account without server-side throttling. In self-hosted deployments, this can be abused to send large volumes of unwanted email and consume downstream email delivery resources. This vulnerability is fixed in 1.180.10.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2026-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/tuist/tuist/security/advisories/GHSA-v7gr-7ww5-w4cx

Check your stack JSON