A critical vulnerability in Taguette versions prior to 1.5.0 allows unauthenticated attackers to perform account takeovers by manipulating password reset workflows.

The application is susceptible to an external control of system configuration settings (CWE-15), specifically involving the password reset mechanism. An unauthenticated attacker can trigger a password reset email containing a malicious link, which, if clicked by the victim, allows the attacker to set the victim email address and compromise the account.

Successful exploitation of this vulnerability leads to full account takeover for any user targeted by an attacker. This results in unauthorized access to sensitive qualitative research data, potential data exfiltration, and a complete loss of confidentiality and integrity for the affected user account. Given the CVSS score of 7.1, this represents a high-severity risk that could undermine the integrity of research projects managed within the platform.

Immediate Action: Upgrade Taguette to version 1.5.0 or later immediately to resolve the vulnerable password reset logic.

Proactive Monitoring: Review application access and authentication logs for unusual password reset requests or unexpected account configuration changes.

Compensating Controls: Implement strict email filtering and user awareness training to ensure staff are cautious when interacting with password reset links originating from the platform.

Public Exploit Available: No.

This vulnerability presents a significant risk to user account security and data confidentiality. System administrators must prioritize upgrading their Taguette instances to version 1.5.0 to eliminate this attack vector. Failure to patch allows attackers to bypass authentication controls and gain unauthorized access to the application environment.