Is there a patch available for EUVD-2026-40155?

Yes, a patch is available for EUVD-2026-40155. Update the affected software to the latest version immediately.

Modoboa EUVD-2026-40155

Q: What is the CVSS score of EUVD-2026-40155?

EUVD-2026-40155 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-56780 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-29 disclosure@vulncheck.com

GHSA-c3qp-4qxm-fwhr

Authentication Bypass

7.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Domain admin privilege required; target PK discovery trivial; full account takeover.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 11:07 vuln.today

Patch available

Jun 29, 2026 - 19:01 EUVD

Analysis Generated

Jun 29, 2026 - 18:31 vuln.today

CVE Published

Jun 29, 2026 - 18:16 cve.org

HIGH 7.7

DescriptionCVE.org

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.

AnalysisAI

Privilege escalation in Modoboa before 2.9.0 allows authenticated domain administrators to reset passwords of any user, including superadmins, via the /api/v1/accounts/{pk}/password/ endpoint due to an insecure direct object reference. An attacker with domain admin privileges can bypass authorization checks to take over higher-privileged accounts. There is no evidence of active exploitation, and the patch is available.

Technical ContextAI

Modoboa is a self-hosted email hosting and management web application built with Django. The vulnerability is an authorization bypass through user-controlled key (CWE-639) in the password change REST endpoint. The endpoint uses the primary key (pk) of the target user directly from the URL without verifying that the requesting domain administrator is authorized to manage that user-for example, a superadmin or a user from a different domain. The fix introduces self.get_object() in the viewset, which enforces Django REST Framework's object-level permissions and ensures the user is within the admin's managed domains.

RemediationAI

Upgrade to Modoboa 2.9.0 or later to apply the patch that enforces domain-scoped access control on the password reset endpoint. No temporary workarounds exist; restricting domain administrator privileges to trusted personnel is the only compensating control, though this does not eliminate the risk from a malicious domain admin.