Tuist: Forgot password flow lacks throttling for reset email delivery
Priority LOW 36CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.
Summary
Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account without server-side throttling. In self-hosted deployments, this can be abused to send large volumes of unwanted email and consume downstream email delivery resources. This vulnerability is fixed in 1.180.10.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed tuist (tuist): 1.180.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA tuist (tuist) Fixed in 1.180.10
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44679
More tuist vulnerabilities
- TI-2026-32574 Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID CVSS 4.0HIGH 7.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences