{"id":"CVE-2026-23760","aliases":["EUVD-2026-4143","GHSA-mj6x-679w-76wr"],"status":"published","title":"SmarterTools SmarterMail \u003c Build 9511 Authentication Bypass via Password Reset API","description":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.96432,"percentile":0.99881,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-288"],"published":"2026-01-22T14:35:17Z","modified":"2026-08-04T05:16:38Z","kev":{"date_added":"2026-01-26","due_date":"2026-02-16","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2026-01-26"},{"source":"kev","since":"2026-01-26"}],"exploits":[{"source":"pocgithub","id":"MaxMnMl/smartermail-CVE-2026-23760-poc","title":"MaxMnMl/smartermail-CVE-2026-23760-poc","date":"2026-01-24","url":"https://github.com/MaxMnMl/smartermail-CVE-2026-23760-poc"},{"source":"pocgithub","id":"HORKimhab/CVE-2026-0001","title":"HORKimhab/CVE-2026-0001","date":"2026-05-13","url":"https://github.com/HORKimhab/CVE-2026-0001"},{"source":"pocgithub","id":"msmacu/smartpwn","title":"msmacu/smartpwn","date":"2026-07-30","url":"https://github.com/msmacu/smartpwn"},{"source":"nuclei","id":"CVE-2026-23760","title":"SmarterTools SmarterMail - Admin Password Reset","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23760.yaml"}],"products":[{"vendor":"smartertools","product":"smartermail"},{"vendor":"smartertools inc.","product":"smartermail"}],"references":[{"url":"https://www.smartertools.com/smartermail/release-notes/current","tags":["release-notes","patch","Release Notes"]},{"url":"https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/","tags":["technical-description","exploit","Exploit","Third Party Advisory"]},{"url":"https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermail","tags":["third-party-advisory","Third Party Advisory"]},{"url":"https://www.vulncheck.com/advisories/smartertools-smartermail-authentication-bypass-via-password-reset-api","tags":["third-party-advisory","Third Party Advisory"]},{"url":"https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce","tags":["third-party-advisory","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23760"},{"url":"https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass"},{"url":"https://github.com/advisories/GHSA-mj6x-679w-76wr"}],"sources":{"cve":[{"id":"CVE-2026-23760","title":"SmarterTools SmarterMail \u003c Build 9511 Authentication Bypass via Password Reset API","description":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.","status":"published","published":"2026-01-22T14:35:17.235Z","modified":"2026-08-04T03:56:03.047Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T13:42:04.39372Z"}],"euvd":[{"id":"EUVD-2026-4143","description":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.","status":"published","published":"2026-01-22T14:35:17Z","modified":"2026-08-04T03:56:03Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"exploited_since":"2026-01-26","updated_at":"2026-11-02T18:02:23.332335Z"}],"ghsa":[{"id":"GHSA-mj6x-679w-76wr","title":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass...","description":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.","status":"published","published":"2026-01-22T15:31:33Z","modified":"2026-01-27T18:33:14Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:05:55.903334Z"}],"kev":[{"id":"CVE-2026-23760","title":"SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability","description":"SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.","cwes":["CWE-288"],"kev":{"date_added":"2026-01-26","due_date":"2026-02-16","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-23760","description":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.","status":"published","published":"2026-01-22T15:16:55.12Z","modified":"2026-08-04T05:16:38.16Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:04.423757Z"}]}}