Insecure Direct Object Reference in Modoboa Email Server

CVE-2026-56780

What is CVE-2026-56780?

An insecure direct object reference vulnerability has been identified in Modoboa versions prior to 2.9.0, specifically in the PUT /api/v1/accounts/{pk}/password/ endpoint. This flaw permits domain administrators to manipulate user passwords freely, which may lead to unauthorized access. Attackers with administrative privileges can bypass critical access controls, allowing them to reset passwords for superadmin accounts and potentially seize full control over affected accounts. It is crucial for users to update to the latest version to mitigate these risks.

References