CVE-2026-56780 — Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change a…
Published: 2026-06-29 · CVSS: 7.7 · CVSS 4.0
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7