PT-2026-41122 · Tuist · Tuist

Pepicrft · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-44679

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tuist versions prior to 1.180.10

Description The forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account because there is no server-side throttling. In self-hosted deployments, this can be used to send large volumes of unwanted email and consume downstream email delivery resources.

Recommendations Update to version 1.180.10.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-44679

Affected Products

Tuist

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-44679 · Security Note
• https://github.com/tuist/tuist/security/advisories/GHSA-v7gr-7ww5-w4cx · Note
• https://t.me/CVEtracker/53835 · Telegram Post
• https://twitter.com/CVEnew/status/2055074227028385961 · Twitter Post