CVE-2026-56780: Modoboa Auth Bypass Vulnerability

CVE-2026-56780 Overview

CVE-2026-56780 is an Insecure Direct Object Reference (IDOR) vulnerability in Modoboa versions before 2.9.0. The flaw exists in the PUT /api/v1/accounts/{pk}/password/ endpoint of the admin API. The endpoint fails to enforce object-level authorization checks against the supplied account primary key.

Any authenticated user with domain administrator privileges can change the password of any account on the server, including superadmin accounts. Successful exploitation leads to full account takeover of the mail hosting platform. The vulnerability is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
A domain administrator can reset the superadmin password through a single authenticated API request, escalating privileges to full control of the Modoboa instance.

Affected Products

Modoboa versions prior to 2.9.0
Modoboa admin API endpoint /api/v1/accounts/{pk}/password/
Deployments exposing the Modoboa REST API to domain administrator accounts

Discovery Timeline

2026-06-29 - CVE-2026-56780 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56780

Vulnerability Analysis

Modoboa is an open-source mail hosting and management platform written in Python and Django. The admin API exposes a password change endpoint at PUT /api/v1/accounts/{pk}/password/. The {pk} parameter is the primary key of the target user account.

Before version 2.9.0, the view handling this endpoint validated that the caller held the domain administrator role but did not validate whether the target account belonged to a domain the caller manages. A domain admin could substitute any pk value, including the primary key of the superadmin account, and set a new password of their choosing.

The issue is documented in the VulnCheck Security Advisory and fixed via pull request #4038.

Root Cause

The root cause is missing object-level access control in the password change viewset within modoboa/admin/api/v1/viewsets.py. The endpoint relied on role-based checks alone. It did not verify the relationship between the authenticated principal and the account identified by pk before applying the password change.

Attack Vector

The vulnerability is exploitable over the network by any user holding domain administrator credentials on the target Modoboa instance. The attacker sends a crafted PUT request to /api/v1/accounts/{pk}/password/ with the primary key of a higher-privileged account and a new password value in the request body. After the request succeeds, the attacker authenticates as the targeted superadmin using the newly set credentials.

python

# Security patch excerpt from modoboa/admin/api/v1/viewsets.py
 """Admin API."""

-from django import http
 from django.contrib.contenttypes.models import ContentType
 from django.utils.translation import gettext as _

Source: GitHub commit a1878c4. The full patch introduces object-level permission checks so that domain administrators can only change passwords for accounts within domains they administer.

Detection Methods for CVE-2026-56780

Indicators of Compromise

PUT requests to /api/v1/accounts/{pk}/password/ where the pk targets a superadmin or an account outside the caller's managed domains.
Successful password changes for privileged accounts followed by login sessions from new source IP addresses or user agents.
Unexpected password reset notifications or authentication failures reported by superadmin users.

Detection Strategies

Enable verbose logging on the Modoboa Django application and correlate password-change API calls with the acting user's role and the target account's role.
Alert on any password change where the caller is a domain administrator and the target is a superadmin or belongs to a different domain scope.
Baseline normal API usage patterns and flag deviations in the frequency or timing of password-change requests.

Monitoring Recommendations

Ship Modoboa web server and application logs to a centralized log platform for retention and query.
Monitor authentication events for superadmin accounts, including source IP, user agent, and geolocation changes.
Review admin activity dashboards for password modifications performed outside of expected administrative workflows.

How to Mitigate CVE-2026-56780

Immediate Actions Required

Upgrade Modoboa to version 2.9.0 or later, which includes the fix from pull request #4038.
Rotate passwords for all superadmin and privileged accounts after upgrading.
Audit the list of domain administrator accounts and remove any that are unnecessary or unused.
Review web server and application logs for prior calls to /api/v1/accounts/{pk}/password/ targeting accounts outside the caller's domain scope.

Patch Information

The fix is committed in a1878c4920a6e47c3217c6ff1ed4a8753c202661 and merged through pull request #4038. The patch adds object-level authorization to the password change viewset in modoboa/admin/api/v1/viewsets.py. Upgrading to Modoboa 2.9.0 is the recommended remediation.

Workarounds

If immediate upgrade is not possible, restrict access to the /api/v1/ endpoints at the reverse proxy layer to trusted management networks only.
Temporarily reduce the number of domain administrator accounts and require additional out-of-band verification for password change operations.
Enforce multi-factor authentication on superadmin accounts to limit the impact of a stolen password.

bash

# Example: upgrade Modoboa via pip in a virtualenv
source /srv/modoboa/env/bin/activate
pip install --upgrade 'modoboa>=2.9.0'
systemctl restart modoboa uwsgi nginx