Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate‑limiting, failed‑attempt counting, or account lockout when the optional captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password‑guessing requests against any account, including administrators, with no throttling. This enables credential compromise and full account takeover, exposing the application’s data and administrative controls. The weakness corresponds to the omission of proper access control measures for authentication attempts, reflected in CWE‑307.

Typemill, the open‑source CMS, is affected. No specific version numbers are listed in the CVE data, so all current releases using the default configuration are potentially impacted.

The CVSS score of 9.1 indicates a critical severity vulnerability. Because the exploit path involves only sending HTTP POST requests to a publicly exposed endpoint, the likelihood of exploitation is high, especially when community‑wide scripts or brute‑force tools are employed. The EPSS score of <1% indicates a very low probability of exploitation, yet the absence of rate limiting still makes the attack trivial for an attacker with internet access. The vulnerability is not listed in CISA’s KEV catalog, but its exploitation potential warrants immediate attention.