CVE-2026-23760 PoC — SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

Title:SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API (CVE-2026-23760)
Description:SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

Detected a SmartMail admin password reset vulnerability by sending a POST request to the `/api/v1/auth/force-reset-password` endpoint, indicating that administrative password resets could potentially be triggered without proper authorization.

 id: CVE-2026-23760

info:
  name: SmarterTools SmarterMail - Admin Password Reset
  author: watchTow

...