Tuist vulnerabilities
Published CVEs affecting Tuist products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-44679
Medium · 6.9
CWE-770 May 14, 2026
Tuist: Forgot password flow lacks throttling for reset email delivery
Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account without server-side throttling. In self-hosted deployments, this can be abused to send large volumes of unwanted email and consume downstream email delivery resources. This vulnerability is fixed in 1.180.10.
CVE-2026-44678
High · 7.1
CWE-639 May 14, 2026
Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID
Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID without verifying that the preview belongs to the project resolved from the URL path. The route's project-level authorization plug (AuthorizationPlug, :preview) authorizes the caller against the project encoded in account_handle/project_handle — which the attacker controls — and then the action deletes whichever preview's UUID is supplied. The check therefore guards the wrong project.