EUVD-2026-40155
GHSA-c3qp-4qxm-fwhr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Domain admin privilege required; target PK discovery trivial; full account takeover.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.
AnalysisAI
Privilege escalation in Modoboa before 2.9.0 allows authenticated domain administrators to reset passwords of any user, including superadmins, via the /api/v1/accounts/{pk}/password/ endpoint due to an insecure direct object reference. An attacker with domain admin privileges can bypass authorization checks to take over higher-privileged accounts. There is no evidence of active exploitation, and the patch is available.
Technical ContextAI
Modoboa is a self-hosted email hosting and management web application built with Django. The vulnerability is an authorization bypass through user-controlled key (CWE-639) in the password change REST endpoint. The endpoint uses the primary key (pk) of the target user directly from the URL without verifying that the requesting domain administrator is authorized to manage that user-for example, a superadmin or a user from a different domain. The fix introduces self.get_object() in the viewset, which enforces Django REST Framework's object-level permissions and ensures the user is within the admin's managed domains.
RemediationAI
Upgrade to Modoboa 2.9.0 or later to apply the patch that enforces domain-scoped access control on the password reset endpoint. No temporary workarounds exist; restricting domain administrator privileges to trusted personnel is the only compensating control, though this does not eliminate the risk from a malicious domain admin.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today