External risk intelligence

Dromara Free-FS Password Reset Code Brute-Force Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-129161

The vulnerability exists in an API endpoint responsible for user password resets (/apis/user/forget-password). Such functionality is typically exposed by web applications to the public internet to allow users to regain access to their accounts, making the vulnerable surface commonly accessible in typical deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in Dromara free-fs software related to password reset functionality. An unauthenticated attacker could potentially guess six-digit reset codes to gain unauthorized access to user accounts. The primary concern is to confirm if this specific software is in use and, if so, to assess potential exposure.

Password resets can be guessed.
Account takeover is possible.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by targeting the password reset feature accessible via a public API. After initiating a password reset for a known email address, the attacker can repeatedly guess the six-digit reset code within its short validity period to gain unauthorized access and set a new password for the account.

Publicly exposed API endpoint.
Brute-forcing six-digit reset codes.
Account takeover via unauthorized password reset.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could take over user accounts by repeatedly guessing six-digit password reset codes sent via PUT /apis/user/forget-password. This brute-force attack exploits an improper restriction of authentication attempts, allowing an attacker to set a new password for a known email address within the code's 300-second validity period.

User accounts are at risk.
Attackers can brute-force reset codes.
Account takeover is the consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The direct impact of this vulnerability, allowing unauthenticated attackers to brute-force password reset codes and take over accounts, suggests that application owners and platform teams are primarily responsible for remediation. The first practical move is to identify all instances of the affected technology, confirm their reachability and business criticality, and then locate the accountable owner to plan a risk-based remediation.

Application or platform owners should lead remediation.
Verify all instances and external exposure.
Plan coordinated maintenance for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dromara free-fs?

Dromara free-fs is a file management system built on Java. It provides essential infrastructure for handling file storage, user management, and system-level operations within a software ecosystem. Organizations deploy it to facilitate secure access to digital assets and account management workflows.

What does CWE-307 mean for CVE-2026-129161?

CWE-307 refers to improper restriction of authentication attempts. In this case, it means the software lacks necessary rate-limiting controls on its password reset process. Because the system does not block repeated failed guesses, an attacker can cycle through numerical possibilities to find the correct code.

How is this password reset flaw triggered?

An attacker initiates a reset for a target email, then sends multiple guesses to the specific API endpoint. The vulnerability exists because the software allows unlimited submission attempts for a six-digit code while it remains valid. It cannot be triggered if the code has already expired or if the attacker does not have a valid target account email.

Is my instance reachable based on Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' external risk because the vulnerable function resides in a public API endpoint. Since password reset features are traditionally exposed to the internet to allow remote user recovery, your instance is likely reachable if you have enabled public access to your Dromara free-fs deployment.

What steps should I take if I use this software?

First, inventory your systems to confirm if you are running Dromara free-fs versions 2.0.1 through 2.3.1. Once identified, evaluate whether the service is publicly exposed or accessible only internally. Coordinate with your platform owners to prioritize remediation and monitor for suspicious authentication traffic on your API endpoints.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.