A flaw in Tuist’s password‑reset mechanism allows an unauthenticated submitter to repeatedly request reset emails for a known account without any server‑side throttling. The attacker can therefore flood the email delivery system, consuming bandwidth, mail‑server resources, and potentially causing delays or denial of service for legitimate users. The weakness is a classic resource‑exhaustion issue (CWE‑770).

The vulnerability affects all self‑hosted deployments of Tuist running any version prior to 1.180.10. The affected product is the Tuist platform for Swift application development. No other vendors or products are impacted.

The CVSS score of 6.9 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is an unauthenticated user triggering many password‑reset requests, so the exploit does not require privileged access. Because the flaw can be abused to send large volumes of email, the risk is significant if the organization relies on its own email infrastructure. Nonetheless, the absence of documented exploits and the medium CVSS score moderate the overall risk.