Taguette CVE-2025-62527

Exploitation requires the attacker to trigger Taguette's password-reset workflow for a targeted user and influence the reset link so it points to attacker-controlled infrastructure (consistent with password-reset/base-URL poisoning). The decisive limiting factor is victim interaction (UI:R): the target must actually receive and click the poisoned reset link for compromise to occur - an unattended or suspicious victim breaks the chain. Exploitation is further bounded to Taguette instances running versions prior to 1.5.0; instances upgraded to 1.5.0 are not affected. No authentication is required of the attacker (PR:N), and the attack is reachable over the network against an exposed Taguette deployment.

This is a moderate-severity (CVSS 7.1) account-security flaw in Taguette, scored AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N by the GitHub Security Advisory source. The network vector and no-privilege requirement make it reachable by unauthenticated remote attackers, but the UI:R (user interaction required) metric is the decisive mitigating signal: exploitation depends on the victim actually clicking an attacker-influenced password-reset link, which caps real-world reliability. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis - the risk is latent rather than demonstrated. No SSVC decision data was supplied. Weighing the signals together, this reads as a genuine but conditional account-takeover-class issue (password-reset link poisoning) rather than a mass-exploitation priority: the high CVSS confidentiality rating reflects potential credential/token compromise, but the required victim interaction plus the product's narrow deployment footprint lower the practical, widespread risk. Note a modeling tension: CWE-15 (External Control of System or Configuration Setting) is an unusual mapping for what the description characterizes as reset-link poisoning - verify the root cause (likely Host-header / base-URL injection) with the vendor advisory.

An attacker submits a password-reset request for a target Taguette user while manipulating the request so the generated reset email contains a link pointing to attacker-controlled infrastructure. When the victim clicks the malicious link, the reset token (or email-change action) is delivered to or triggered toward the attacker, enabling account or email takeover. No public proof-of-concept was provided, and successful exploitation hinges on the victim clicking the link (UI:R).