high7.5
CVE-2026-56780
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administ…
Impact
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.
Affected products
| Product | Affected versions |
|---|---|
| Modoboa | before 2.9.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.