Typemill CVE-2026-71213

Requires that captcha be disabled on the login form - this is the default configuration - and that the target account use a guessable or reused password, since the flaw only removes the throttle, it does not bypass authentication. Exploitation is limited by password strength (strong, high-entropy credentials remain infeasible to brute-force even without lockout), by any network-layer rate-limiting or WAF in front of the app, and by the attacker needing a valid username. If an operator has enabled captcha or the optional secondary email-authcode step, the primary attack surface is reduced.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1) reflects network-reachable, unauthenticated, low-complexity access - accurate for the missing control itself - but the C:H/I:H impact is contingent: this is a brute-force *enabler*, not a direct compromise, so actual account takeover depends on password strength, making the effective attack complexity higher than the vector suggests. No EPSS score was provided, there is no KEV listing, and no POC is referenced, so all signals point to a real-but-not-imminent priority rather than mass exploitation. The 'Information Disclosure' tag is a mismatch for a brute-force weakness and should not be treated as authoritative. Net: prioritize because it exposes admin accounts on internet-facing installs, but realistic impact is gated by credential hygiene.

An attacker discovers an internet-facing Typemill site, identifies the admin username (often 'admin' or an author name published on the site), and scripts thousands of POST /tm/login requests cycling a password wordlist. With no throttling or lockout on default installs, the attack runs at full speed until a valid credential is found, granting content-management and configuration control. No POC is referenced, but the attack requires only a standard HTTP client.