Is there a patch available for EUVD-2026-30485?

Yes, a patch is available for EUVD-2026-30485. Update the affected software to the latest version immediately.

Tuist EUVD-2026-30485

Q: What is the CVSS score of EUVD-2026-30485?

EUVD-2026-30485 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-44679 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-14 security-advisories@github.com

Denial Of Service

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.8 MEDIUM

Network-reachable with no auth or interaction; scope changes to downstream email infrastructure (SA:L in 4.0 terms), hence S:C/A:L; no confidentiality or integrity impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:10 vuln.today

Patch available

May 14, 2026 - 22:02 EUVD

CVE Published

May 14, 2026 - 21:16 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account without server-side throttling. In self-hosted deployments, this can be abused to send large volumes of unwanted email and consume downstream email delivery resources. This vulnerability is fixed in 1.180.10.

AnalysisAI

Unauthenticated email flooding via the forgot-password endpoint in Tuist affects self-hosted deployments prior to version 1.180.10. The password reset flow lacks server-side rate limiting (CWE-770), enabling any attacker with knowledge of a valid account email to programmatically trigger unlimited reset emails. No public exploit has been identified at time of analysis, and EPSS sits at just 0.05% (16th percentile), though SSVC flags the attack as automatable.

Technical ContextAI

Tuist is an open-source toolchain used by Swift/iOS developers to manage Xcode projects at scale. The vulnerability resides in its self-hosted deployment's password reset API endpoint, which performs no server-side throttling on how many times a password reset email may be requested for a given account. CWE-770 (Allocation of Resources Without Limits or Throttling) captures the root cause: the application allocates email delivery actions on behalf of unauthenticated callers with no bound on request rate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the endpoint is network-reachable with no prerequisites, and the SA:L metric reflects that the downstream email delivery infrastructure - not the Tuist application itself - bears the availability impact.

RemediationAI

Upgrade Tuist to version 1.180.10 or later, which introduces server-side throttling on the password reset flow per the vendor advisory at https://github.com/tuist/tuist/security/advisories/GHSA-v7gr-7ww5-w4cx. If an immediate upgrade is not feasible, compensating controls for self-hosted deployments include placing the Tuist instance behind a reverse proxy (e.g., nginx or Caddy) configured to rate-limit requests to the /password-reset or equivalent endpoint by source IP - for example, allowing no more than 5 requests per minute per IP. A WAF rule targeting the specific reset endpoint provides an alternative layer. Note that IP-based rate limiting alone can be bypassed by distributed sources, so it should be paired with CAPTCHA on the password reset form where the UI allows. These controls do not address the root cause and should be treated as temporary measures only.