CVE-2026-31881 Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window
Unauthenticated attackers can reset the admin password during an active reset window, leading to full operator account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31881?
CVE-2026-31881 is a high-severity missing authorization vulnerability in runtipi, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, resulting in full account takeover. The endpoint POST /api/auth/reset-password is exposed without authentication/authorization checks. During the 15-minute reset window, any remote user can set a new operator password and log in as admin. This vulnerability is fixed in 4.8.0.
Weakness: CWE-306
Which versions are affected by CVE-2026-31881?
It affects 1 product.
Products include Runtipi Runtipi.
How do I fix CVE-2026-31881?
No fix has been published for CVE-2026-31881 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-31881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31881 exists.
Other vulnerabilities in runtipi
- CVE-2026-32729 Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp`
- CVE-2026-24129 Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Execution
- CVE-2026-25116 Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal
Sources
Also known as GHSA-96fm-whrc-cwg3.