EUVD-2026-53210
GHSA-4265-6rqg-273h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network, unauthenticated, no UI (PR:N/UI:N), but AC:H because success is contingent on a guessable password outside attacker control; full account compromise gives C:H/I:H, no availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
6DescriptionCVE.org
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the same file protects an optional secondary email-authcode step and does not apply to the primary password check.
AnalysisAI
Credential brute-forcing against Typemill CMS (versions up to and including 2.25.0) is possible because its primary password-login endpoint (POST /tm/login, ControllerWebAuth::login()) implements no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled - the default state. Any unauthenticated attacker can submit unlimited password guesses against any account, including administrators, enabling account takeover of weakly-protected credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
Typemill is a lightweight flat-file (no-database) PHP CMS used for building documentation sites and small websites. The root cause is CWE-307 (Improper Restriction of Excessive Authentication Attempts): the authentication controller enforces attempt-counting and lockout only on an optional secondary email-authcode step, while the mandatory primary password check in the same ControllerWebAuth::login() method is left entirely unthrottled. Because captcha - the only anti-automation control on the password path - is disabled by default, the login form accepts an unbounded stream of guesses. The single affected package per CPE is cpe:2.3:a:typemill:typemill covering all versions through 2.25.0.
RemediationAI
No vendor-released patch identified at time of analysis - no fix version is present in the input data, and the only references are the upstream GitHub repository (https://github.com/typemill/typemill) and the VulDB advisory (https://vuldb.com/vuln/386095), so monitor the project for a release above 2.25.0. As the most direct compensating control, enable the captcha option on the login form, which activates the anti-automation path that is off by default (trade-off: adds friction and a small accessibility burden for legitimate logins). Additionally, place /tm/login behind a reverse-proxy or WAF rate-limit / fail2ban rule keyed on client IP (trade-off: distributed or proxied attackers can evade IP-based limits), restrict the /tm admin path to known management IPs or a VPN (trade-off: breaks remote editor access from arbitrary networks), and enforce strong/unique admin passwords plus the optional secondary email-authcode step, which does retain lockout logic. Do not rely on any invented fix version.
Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. Rated high sev
Reflected XSS in Typemill's login error page allows unauthenticated attackers to inject malicious scripts by crafting re
Arbitrary file read in Typemill before 2.24.0 allows authenticated Author-level users to traverse outside the content di
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious Jav
Stored HTML attribute injection in Typemill versions prior to 2.23.0 allows authenticated content editors to embed arbit
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today