The login endpoint of Typemill accepts POST requests to /tm/login without applying any rate limiting, failed‑attempt counting, or account lockout when the optional captcha is disabled. An unauthenticated attacker can therefore submit an unlimited number of password guesses against any user account, including administrators, with no throttling. This allows credential compromise and full account takeover, exposing the application’s data and administrative controls. The weakness corresponds to the omission of proper access control measures for authentication attempts, reflected in CWE‑307.

Typemill, the open‑source CMS, is affected. No specific version numbers are listed in the CVE data, so all current releases using the default configuration are potentially impacted.

The CVSS score of 8.1 indicates a high severity vulnerability. Because the exploit path involves only sending HTTP POST requests to a publicly exposed endpoint, the likelihood of exploitation is high, especially when community‑wide scripts or brute‑force tools are employed. The EPSS value is not available, but the absence of rate limiting makes the attack trivial for an attacker with internet access. The vulnerability is not yet listed in CISA’s KEV catalog, but its exploitation potential warrants immediate attention.