The vulnerability in Runtipi allows an unauthenticated attacker to reset the operator (admin) password during an active password‑reset window. The POST /api/auth/reset-password endpoint lacks authentication or authorization checks, enabling any remote user to set a new operator password within a 15‑minute window. This results in full operator account takeover, granting the attacker full control and the ability to compromise all hosted services and data. The flaw is a CWE-306 style authentication bypass.

The flaw affects all Runtipi installations running versions earlier than 4.8.0. The issue is fixed in Runtipi 4.8.0 and later. The affected product is the Runtipi personal homeserver orchestrator, as identified by the cpe:2.3:a:runtipi:runtipi:*:*:*:*:*:*:*:*.

The CVSS score of 7.7 indicates high severity, while the EPSS score of under 1% suggests that exploitation may be unlikely at present. Since the vulnerability is not listed in CISA’s KEV table, it is not known to be widely exploited. Attackers would need only to trigger the password‑reset process and wait for the 15‑minute window; no special access is required, making the attack straightforward for an unauthenticated remote user.