{"id":"EUVD-2026-84112","enisaUuid":"530f292c-de02-35a9-8779-42bce5ab2218","description":"Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.","datePublished":"Sep 21, 2026, 7:50:14 PM","dateUpdated":"Sep 24, 2026, 10:36:41 PM","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9\n","aliases":"CVE-2026-58271\nGHSA-274f-6w77-8qm9\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"435de054-c536-33f6-aad0-91fcb722e049","product":{"name":"Server","vendor":{"name":"Devolutions"}},"product_version":"\u003c 2.4.0"}],"enisaIdVendor":[{"id":"b7827745-8d96-325c-a30b-4e8191598c6a","vendor":{"name":"Sync-in"}}],"enisaIdVulnerability":[{"id":"7d790859-411d-3e0c-b312-62b958d6de3d","vulnerability":{"id":"GHSA-274f-6w77-8qm9","description":"@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`","datePublished":"Sep 22, 2026, 2:44:43 PM","dateUpdated":"Sep 22, 2026, 2:44:43 PM","baseScore":0.0,"references":"https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58271\nhttps://github.com/Sync-in/server/pull/228\nhttps://github.com/Sync-in/server/commit/b13a4aad5c2b38fe8231a0d007cd08a086ec5bdb\nhttps://github.com/Sync-in/server\nhttps://github.com/Sync-in/server/releases/tag/v2.4.0\n","enisa_id":"EUVD-2026-84112\n","aliases":"CVE-2026-58271\nGHSA-274f-6w77-8qm9\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ef5b945b-7cc0-30b0-a6c0-066ac6cb5679","vulnerability":{"id":"CVE-2026-58271","description":"Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.","datePublished":"Sep 21, 2026, 7:50:14 PM","dateUpdated":"Sep 24, 2026, 10:36:41 PM","status":"PUBLISHED","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/Sync-in/server/security/advisories/GHSA-274f-6w77-8qm9\n","enisa_id":"EUVD-2026-84112\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 11, 2026, 7:23:15 AM","vulnerabilityProduct":[{"id":"db8ccbd6-5bb4-3432-8d71-1cb6aea5f7b2","product":{"name":"Server","vendor":{"name":"Devolutions"}},"product_version":"\u003c 2.4.0"}],"vulnerabilityVendor":[{"id":"bc5244ef-71b9-32e9-af3c-5bf920ad5397","vendor":{"name":"Sync-in"}}]}}],"enisaIdAdvisory":[]}