https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T07:43:13.242780+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-56780 CVE-2026-56780 — Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API 2026-10-08T07:43:13.258897+00:00

Affected: modoboa

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.