An insecure direct object reference vulnerability in Modoboa allows domain administrators to perform unauthorized password resets, leading to full system compromise.

The vulnerability exists in the PUT /api/v1/accounts/{pk}/password/ endpoint. It stems from a lack of proper object-level access controls, allowing an authenticated domain administrator to target the primary key (pk) of any other user or superadmin to reset their password without authorization.

The CVSS score of 7.5 highlights the severity of this privilege escalation flaw. By allowing a domain administrator to reset a superadmin password, an attacker can achieve a full account takeover, gaining complete control over the email infrastructure, managing domains, and accessing sensitive communications, which carries severe reputational and operational consequences.

Immediate Action: Upgrade to Modoboa version 2.9.0 or later to implement proper authorization checks on the password reset API endpoint.

Proactive Monitoring: Review administrative audit logs for any suspicious password reset activities or unexpected changes to account security settings.

Compensating Controls: Restrict access to the API endpoints to known, trusted IP addresses and implement strict role-based access control (RBAC) until the patch can be applied.

Public Exploit Available: false

Given the potential for complete system takeover, administrators should move quickly to update Modoboa to version 2.9.0. This update is critical to closing the authorization gap that currently allows domain administrators to exceed their intended privilege level.