CVE-2026-31881 | Runtipi up to 4.7.x Endpoint /api/auth/reset-password missing authentication (GHSA-96fm-whrc-cwg3)

A vulnerability was found in Runtipi up to 4.7.x. It has been declared as critical. Affected by this issue is some unknown functionality of the file /api/auth/reset-password of the component Endpoint. The manipulation results in missing authentication.

This vulnerability was named CVE-2026-31881. The attack may be performed from remote. There is no available exploit.

It is recommended to upgrade the affected component.