PT-2026-24792 · Git+1 · Runtipi

Fy0Lai · CVE-2026-31881 · Published 2026-03-11 · Updated 2026-03-12

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Runtipi versions prior to 4.8.0

Description Runtipi is a personal homeserver orchestrator. An unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, leading to full account takeover. The API endpoint ''/api/auth/reset-password'' is exposed without authentication or authorization checks. During the 15-minute reset window, any remote user can set a new operator password and log in as administrator.

Recommendations Update to version 4.8.0 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-31881

GHSA-96FM-WHRC-CWG3

Affected Products

Runtipi

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31881.json · Exploit
• https://github.com/runtipi/runtipi/security/advisories/GHSA-96fm-whrc-cwg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31881 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31881 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031992365548970364 · Twitter Post