CVE-2026-56780: Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-07-01
Weakness: CWE-639

Description

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.

Affected products

modoboa/modoboa: before 2.9.0 — fixed in 2.9.0

How to fix

Upgrade to a fixed version: modoboa/modoboa 2.9.0. Check the vendor advisory for mitigations.

References

https://github.com/modoboa/modoboa/commit/a1878c4920a6e47c3217c6ff1ed4a8753c202661
https://github.com/modoboa/modoboa/pull/4038
https://www.vulncheck.com/advisories/modoboa-insecure-direct-object-reference-in-account-password-change-api

Get alerted when CVE-2026-56780 or the next vulnerability affects your stack