Description

SmarterTools SmarterMail contains an unauthenticated administrative password reset vulnerability. The application exposes an API endpoint that accepts password reset requests without verifying a secret. By sending a crafted POST request with a target username and desired password, a remote unauthenticated attacker can overwrite the administrator's credentials, gaining full control over the mail server administration interface.

Remediation

Upgrade SmarterMail to the latest patched version and ensure all security updates are applied regularly.

References

Attackers with Decompilers Strike Again: SmarterTools SmarterMail WT-2026-0001 Auth Bypass

NVD - CVE-2026-23760

Related Vulnerabilities

OpenSSL NULL Pointer Dereference Vulnerability (CVE-2026-28388)

Roundcube Improper Input Validation Vulnerability (CVE-2011-1492)

Joomla! Core Security Bypass (2.5.0 - 3.8.7)

Moodle Improper Input Validation Vulnerability (CVE-2013-2083)

Internet Information Services Other Vulnerability (CVE-1999-1478)

Severity

Critical

Classification

CVE-2026-23760 CWE-288 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Authentication Bypass Known Vulnerabilities