CVE-2026-129161: Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover
Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The affected versions are Dromara free-fs 2.0.1 through 2.3.1. Any deployment in that range with the password-reset endpoint exposed is vulnerable to unauthenticated password-reset code guessing.
What does an attacker need to take over an account?
An attacker needs to know an account's email address and request a password-reset code for it. They can then submit unlimited guesses for the six-digit code during its 300-second validity period and set a password of their choice if a guess succeeds.
Is authentication required to exploit this issue?
No. The vulnerable PUT /apis/user/forget-password endpoint can be targeted by an unauthenticated attacker.
What is the practical impact of successful exploitation?
A successful attacker can reset the target user's password and take over that account. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.