Vulnerabilities

TI-2026-25221 CVE-2026-32729

Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`

HIGH 73

Runtipi is a personal homeserver orchestrator.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00387 Published 2026-03-13 Fixed in 4.8.1 CWE-307

TI-2026-24433 CVE-2026-31881

HIGH 76

Runtipi is a personal homeserver orchestrator.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.005 Published 2026-03-11 Fixed in 4.8.0 CWE-306

TI-2026-20279 CVE-2026-25116

LOW 39

Runtipi is a personal homeserver orchestrator.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00631 Published 2026-01-29 Fixed in 4.7.2 CWE-22

TI-2026-19447 CVE-2026-24129

HIGH 73

Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00535 Published 2026-01-22 Fixed in 4.7.0 CWE-78