https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T05:39:15.929357+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-331709 EUVD-2026-331709 2026-10-08T05:39:15.976630+00:00 EUVD-2026-331709 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56780 fkie_cve-2026-56780 2026-10-08T05:39:15.976669+00:00

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.

 https://cve.radiocsirt.org/vuln/ghsa-c3qp-4qxm-fwhr GHSA-c3qp-4qxm-fwhr 2026-10-08T05:39:15.976705+00:00

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.