CVE-2026-71213

Name of the Vulnerable Software and Affected Versions Typemill (affected versions not specified)

Description The login endpoint 'POST /tm/login' using the login() function in ControllerWebAuth lacks rate-limiting, failed-attempt counting, and account lockout mechanisms when the captcha is disabled, which is the default setting. This allows an unauthenticated attacker to perform unlimited password-guessing attacks against any account, including those with administrator privileges, without throttling. While some lockout logic exists within the same file, it only applies to the optional secondary email-authcode verification step and not to the primary password validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.