CVE-2026-56780: Modoboa Password Reset IDOR Vulnerability (CWE-639)

Technical summary

The vulnerability exists in the PUT /api/v1/accounts/{pk}/password/ endpoint, where the application fails to properly validate that the authenticated user has permission to modify the target account's password. An attacker with domain administrator credentials can construct requests to arbitrary account identifiers (pk values) and successfully change passwords without hitting access control checks. The issue is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a variant of insecure direct object reference. The API does not sufficiently scope password reset operations to accounts the domain admin actually manages, allowing lateral privilege escalation to superadmin accounts.

Business impact

A compromised domain administrator account becomes a pivot point for complete system compromise. Attackers can reset superadmin passwords and gain unrestricted access to all mail, groupware data, and administrative functions. This threatens confidentiality (reading private mail and organizational data), integrity (modifying messages, user accounts, and system settings), and availability (disabling accounts, deleting data). For organizations relying on Modoboa for email and collaboration, this represents a critical risk to business continuity and regulatory compliance (GDPR, HIPAA, etc.) if customer or sensitive data is exposed.

Affected systems

Modoboa versions before 2.9.0 are vulnerable. The vulnerability requires network access to the API endpoint and valid domain administrator credentials, so it is relevant to any Modoboa deployment with multiple administrators or multi-tenant environments. Self-hosted instances and commercial deployments using vulnerable versions are at risk.

Exploitability

Exploitation requires valid domain administrator credentials and network access to the API. The attack is straightforward once authenticated: an attacker simply needs to identify target account IDs and issue PUT requests with new passwords. No user interaction or special techniques are required beyond standard API calls. The barrier to exploitation is low for internal threats or attackers who have already compromised a domain admin account. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, but the simplicity and high impact of exploitation mean defenders should assume it will be actively weaponized once disclosed.

Remediation

Upgrade Modoboa to version 2.9.0 or later, which contains fixes to enforce proper authorization checks on the password reset endpoint. Verify the fix with the vendor advisory before deployment. As an interim measure, restrict API access through network-level controls (firewall rules, VPN) and monitor API logs for suspicious password reset requests from domain admin accounts, particularly those targeting superadmin accounts.

Patch guidance

Apply Modoboa version 2.9.0 or later as soon as testing permits. Consult the Modoboa project's official release notes and security advisories to confirm the patch version and any additional configuration changes required. If you operate a self-hosted instance, prioritize this update in your patch cycle; if using a managed service, verify with your provider that they have deployed the fix. Test in a non-production environment first to ensure compatibility with your customizations or extensions.

Detection guidance

Monitor API access logs for PUT requests to /api/v1/accounts/{pk}/password/ from domain administrator accounts, especially targeting account IDs that differ from the authenticated user's own account ID. Flag any successful password resets for superadmin accounts (typically low ID numbers or known admin account names). Implement rate-limiting on the endpoint to reduce attack velocity. Use SIEM tools to correlate multiple password reset attempts from the same admin account over a short window. If you have deployed Modoboa, review recent password reset logs for any unauthorized changes.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.5) and enables full account takeover with only domain admin-level access. The combination of high impact (confidentiality, integrity, availability), low attack complexity once authenticated, and the simplicity of exploitation make it a priority for any organization running Modoboa. The lack of KEV listing does not diminish urgency; internal threats or attackers with compromised domain admin credentials can immediately escalate to superadmin. Patch as soon as safely feasible.

Risk score, explained

The CVSS 7.5 score reflects a networked attack requiring low-level authentication (domain admin), but resulting in high impact across all three security dimensions. The attack is not complex (AC:H reflects the authentication barrier, not technical complexity). No user interaction is needed, and the scope is unchanged (the compromised account is within the same authorization boundary as the attacker). The score appropriately captures the severity: a domain admin should not be able to reset a superadmin password, and the design flaw creates an immediate path to full system compromise.

Frequently asked questions