---
id: "CVE-2026-108048"
kind: "vulnerability"
aliases: ["CVE-2026-108048"]
title: "Alosuite: password recovery endpoint has no request limit, enabling email floods"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["alosuite", "other", "password-recovery", "self-hosted"]
not_affected_if: ["no-public-access", "rate-limited-upstream"]
published_at: "2026-11-03T13:17:17+00:00"
first_seen_at: "2026-11-03T13:20:52+00:00"
updated_at: "2026-11-03T13:21:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108048", "first_seen_at": "2026-11-03T13:20:52+00:00"}]
---

# Alosuite: password recovery endpoint has no request limit, enabling email floods

The /Account/resetPwd endpoint in Alosuite does not limit how many password reset requests can be sent for one account. A remote attacker can repeatedly trigger reset emails to a user, flooding their inbox and consuming email and application resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether your deployment runs Alosuite and exposes the `/Account/resetPwd` endpoint
- Test whether repeated reset requests for one account are throttled or blocked (unknown from the sources)

## Timeline

- 2026-11-03T13:20:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108048

## From the sources

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_