CVE-2026-56780: Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API
Published Jun 29, 2026
·Updated
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.
Affected Software
1 affected component
Modoboa Modoboa<2.9.0
Event History
Jun 29, 2026
CVE Published
via MITRE·05:14 PM
Data Sourced
via MITRE·05:14 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-56780?
CVE-2026-56780 has a high severity rating of 7.5.
2
How do I fix CVE-2026-56780?
To mitigate CVE-2026-56780, upgrade Modoboa to version 2.9.0 or later.
3
What exploit does CVE-2026-56780 enable?
CVE-2026-56780 allows attackers with domain admin privileges to change any user's password.
4
What is affected by CVE-2026-56780?
CVE-2026-56780 affects Modoboa versions prior to 2.9.0.
5
Who can be impacted by CVE-2026-56780?
Domain administrators can be impacted as they can exploit this vulnerability to gain unauthorized password access.