CVE-2026-56780

High

Description

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.

SeverityHigh

CVSS7.5

Exploit probability—

ProductModoboa

PublishedJun 29, 2026

First seenJun 29, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

modoboa modoboa2.9.0 or later

Patches

github.com/modoboa/modoboa/commit/a1878c4920a6e47c3217c6ff1ed4a8753c202661

Affected products

Product	Affected versions	Fixed in
modoboa modoboa	v < 2.9.0	2.9.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.