CVE-2026-31881: Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window
Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, resulting in full account takeover. The endpoint POST /api/auth/reset-password is exposed without authentication/authorization checks. During the 15-minute reset window, any remote user can set a new operator password and log in as admin. This vulnerability is fixed in 4.8.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31881?
CVE-2026-31881 is rated as a critical vulnerability due to the potential for operator account takeover.
How do I fix CVE-2026-31881?
To fix CVE-2026-31881, upgrade Runtipi to version 4.8.0 or later.
Who is affected by CVE-2026-31881?
Users of Runtipi versions prior to 4.8.0 are vulnerable to CVE-2026-31881.
What can an attacker do with CVE-2026-31881?
An attacker can take over the operator (admin) account by resetting the password during an active reset request.
Is authentication required to exploit CVE-2026-31881?
No, CVE-2026-31881 can be exploited by unauthenticated attackers.