CVE-2026-60046
HighCVSS 7.5Summary
An unauthenticated remote attacker can perform password resets for any user with a known username and email without rate limiting.
Risk Assessment
This can result in a total loss of availability since user passwords can be reset by the attacker.
Recommendation
Apply the vendor patches and implement rate limiting for password reset requests along with additional identity verification.
Other vulnerabilities in Backend web application
See all- CVE-2026-60041High
An unauthenticated remote attacker can perform a CSRF attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
- CVE-2026-60036High
A high-privileged remote attacker can perform code injection in the backend's patch activate function, leading to code execution.
- CVE-2026-60035High
A high-privileged remote attacker can perform code injection in the backend's network auth function, leading to code execution.
- CVE-2026-60043Critical
An unauthenticated remote attacker can perform an XSS attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
Original NVD description (English source)
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS