CVE-2026-56780CWE-639

Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API

High · published June 29, 2026

CVSS v4.0
7.7
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-29T17:14Z
EPSS history
Timeline
  • 29 JUN 17:14Z
    Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API
    cvelistv5