Critical · published January 22, 2026
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 An unauthenticated attacker can reset any admin password with just a username! SmarterMail versions prior to build 9511 have a sneaky flaw that completely bypasses authentication — a critical red alert! 🔥 Think of a hotel where anyone can walk up to the front desk and change the lock on the manager's office without even showing ID! This vulnerability allows malicious users to reset the password of system admin accounts without the usual checks, similar to a rogue guest commandeering the hotel management without permission. The consequences here are absolutely devastating. An attacker could take over your entire SmarterMail instance, executing operating system commands and gaining SYSTEM or root access to the host. This means they can not only control your email server but also access sensitive information and manipulate system settings at will!
Think of a hotel where anyone can walk up to the front desk and change the lock on the manager's office without even showing ID! This vulnerability allows malicious users to reset the password of system admin accounts without the usual checks, similar to a rogue guest commandeering the hotel management without permission. The flaw lies in the password reset API's force-reset-password endpoint, which allows anonymous requests without verifying the existing password or a reset token. This means that an attacker can easily reset an admin's password by simply providing the admin username and a new password.
The consequences here are absolutely devastating. An attacker could take over your entire SmarterMail instance, executing operating system commands and gaining SYSTEM or root access to the host. This means they can not only control your email server but also access sensitive information and manipulate system settings at will! Immediate action is essential! Upgrade to SmarterMail build 9511 or later to patch this vulnerability. Additionally, review your authentication policies and consider implementing stricter controls on password reset functionalities. Ensure that your system administrators are aware of this critical issue! You've got this! Follow these steps, and you'll be well on your way to securing your SmarterMail instance. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| smartertools/smartermail | < 100.0.9511 | 100.0.9511 |