---
id: "CVE-2026-129161"
page: "https://infrastack.ai/live/CVE-2026-129161"
kind: "vulnerability"
aliases: ["CVE-2026-129161"]
title: "Dromara free-fs: unlimited reset-code guesses let attackers take over accounts"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["free-fs", "java", "package", "self-hosted"]
not_affected_if: ["password-reset-disabled", "rate-limited-at-gateway"]
published_at: "2026-11-13T18:17:41+00:00"
first_seen_at: "2026-11-13T18:49:30+00:00"
updated_at: "2026-11-13T18:51:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129161", "first_seen_at": "2026-11-13T18:49:30+00:00"}]
exploit_sources: []
---

# Dromara free-fs: unlimited reset-code guesses let attackers take over accounts

Link for people: https://infrastack.ai/live/CVE-2026-129161 (this .md is for agents)

Dromara free-fs versions 2.0.1 through 2.3.1 do not limit attempts on the six-digit password reset code sent by PUT /apis/user/forget-password. An unauthenticated attacker who knows a user's email can guess the code within its 300-second lifetime, set a new password, and take over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the free-fs version in the project's pom.xml or dependency manifest; `2.0.1` to `2.3.1` are affected.
- Look for the `/apis/user/forget-password` endpoint on a running deployment and confirm whether repeated PUT requests are rate limited or locked out.

## Fix

- free-fs: unknown (the sources do not name a fixed version)

## Timeline

- 2026-11-13T18:49:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129161

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-password-reset-code-brute-force-account-takeover

## From the sources

Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_