Improper Authentication in Dromara Free-FS Affects Account Security

CVE-2026-129161

What is CVE-2026-129161?

Dromara Free-FS versions 2.0.1 through 2.3.1 feature an improper authentication restriction vulnerability. This flaw permits unauthenticated attackers to execute brute-force attacks against six-digit password reset codes via the endpoint /apis/user/forget-password. Attackers can request a code for a known email address and make an unlimited number of guesses during the 300-second validity period of the code. By successfully guessing the code, an attacker can reset the password and gain unauthorized access to user accounts, posing a significant risk to account security.

References