CVE-2026-129161 · Package
NO FIX YET · SEE WHAT TO DO
Dromara free-fs versions 2.0.1 through 2.3.1 do not limit attempts on the six-digit password reset code sent by PUT /apis/user/forget-password. An unauthenticated attacker who knows a user's email can guess the code within its 300-second lifetime, set a new password, and take over the account.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any deployment of free-fs in the affected range that exposes the password reset endpoint to the internet is exposed, because the endpoint needs no login. Deployments that have disabled password reset or that sit behind a gateway enforcing strict rate limits on that route are less exposed. The sources do not say whether a fixed version exists.
Not affected if password-reset-disabled, rate-limited-at-gateway
Who cares free-fs, java, self-hosted
2.0.1 to 2.3.1 are affected./apis/user/forget-password endpoint on a running deployment and confirm whether repeated PUT requests are rate limited or locked out.Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.