What is the CVSS score of CVE-2026-31881?

CVE-2026-31881 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Runtipi are affected by CVE-2026-31881?

An unauthenticated attacker can reset administrator passwords in Runtipi homeserver deployments, enabling complete account takeover and potential compromise of all hosted services and data.

How to fix or mitigate CVE-2026-31881?

Within 24 hours: Identify all Runtipi instances in your environment and document their versions and network exposure. Within 7 days: Implement network segmentation to restrict access to the password reset endpoint (/api/auth/reset-password) or disable the password reset feature if operationally feasible. Within 30 days: Upgrade to Runtipi 4.8.0 or later, or if unavailable, implement WAF rules blocking unauthenticated POST requests to the reset-password endpoint and monitor for suspicious reset attempts.

Runtipi CVE-2026-31881

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-11 security-advisories@github.com

Authentication Bypass

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 19:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, resulting in full account takeover. The endpoint POST /api/auth/reset-password is exposed without authentication/authorization checks. During the 15-minute reset window, any remote user can set a new operator password and log in as admin. This vulnerability is fixed in 4.8.0.

AnalysisAI

Runtipi versions prior to 4.8.0 allow unauthenticated attackers to reset the admin password through an unprotected POST /api/auth/reset-password endpoint, enabling complete account takeover during active password-reset windows. Any remote user can set a new operator password within the 15-minute reset window without authentication or authorization checks. This vulnerability remains unpatched in affected versions.

Technical ContextAI

This vulnerability (CWE-306: Missing Authentication for Critical Function) exists in the full account takeover. The component. Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, resulting in full account takeover. The endpoint POST /api/auth/reset-password is exposed without authentication/authorization checks. During the 15-minute reset window, any remote user can set a new operator password and log in as admin. This vulnerability is fixed in 4.8.0.