CVE-2026-71213
CriticalCVSS 9.1Summary
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the same file protects an optional secondary email-authcode step and does not apply to the primary password check.
Risk Assessment
Lack of rate limiting and account lockout enables brute-force password attacks, potentially leading to administrator account takeover and full system compromise.
Recommendation
Enable captcha or implement rate limiting, failed-attempt counting, and account lockout for the login endpoint. Consider enforcing strong passwords and additional security measures such as MFA.
Original NVD description (English source)
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the same file protects an optional secondary email-authcode step and does not apply to the primary password check.