{"cve_id":"CVE-2026-23760","summary":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"epss":0.77916,"ranking_epss":0.99001,"kev":true,"propose_action":"SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.","ransomware_campaign":"Known","references":["https://code-white.com/public-vulnerability-list/#authenticationserviceforceresetpassword-missing-authentication-in-smartermail","https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/","https://www.smartertools.com/smartermail/release-notes/current","https://www.vulncheck.com/advisories/smartertools-smartermail-authentication-bypass-via-password-reset-api","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-23760","https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce"],"published_time":"2026-01-22T15:16:55","cpes":["cpe:2.3:a:smartertools:smartermail:1.0.0","cpe:2.3:a:smartertools:smartermail:1.2.0","cpe:2.3:a:smartertools:smartermail:1.5.0","cpe:2.3:a:smartertools:smartermail:1.5.1","cpe:2.3:a:smartertools:smartermail:1.5.2","cpe:2.3:a:smartertools:smartermail:1.6.0","cpe:2.3:a:smartertools:smartermail:1.6.1","cpe:2.3:a:smartertools:smartermail:1.6.2","cpe:2.3:a:smartertools:smartermail:1.6.3","cpe:2.3:a:smartertools:smartermail:1.6.4","cpe:2.3:a:smartertools:smartermail:1.65.1727","cpe:2.3:a:smartertools:smartermail:10.0.4562","cpe:2.3:a:smartertools:smartermail:10.0.4573","cpe:2.3:a:smartertools:smartermail:10.0.4583","cpe:2.3:a:smartertools:smartermail:10.1.4597","cpe:2.3:a:smartertools:smartermail:10.2.4618","cpe:2.3:a:smartertools:smartermail:10.3.4632","cpe:2.3:a:smartertools:smartermail:10.4.4653","cpe:2.3:a:smartertools:smartermail:10.5.4682","cpe:2.3:a:smartertools:smartermail:10.6.4703","cpe:2.3:a:smartertools:smartermail:10.6.4717","cpe:2.3:a:smartertools:smartermail:10.7.4765","cpe:2.3:a:smartertools:smartermail:10.7.4786","cpe:2.3:a:smartertools:smartermail:10.7.4787","cpe:2.3:a:smartertools:smartermail:10.7.4807","cpe:2.3:a:smartertools:smartermail:10.7.4821","cpe:2.3:a:smartertools:smartermail:100.0.7537","cpe:2.3:a:smartertools:smartermail:100.0.7803","cpe:2.3:a:smartertools:smartermail:100.0.9336","cpe:2.3:a:smartertools:smartermail:100.0.9340","cpe:2.3:a:smartertools:smartermail:100.0.9350","cpe:2.3:a:smartertools:smartermail:100.0.9357","cpe:2.3:a:smartertools:smartermail:100.0.9362","cpe:2.3:a:smartertools:smartermail:100.0.9363","cpe:2.3:a:smartertools:smartermail:100.0.9364","cpe:2.3:a:smartertools:smartermail:100.0.9371","cpe:2.3:a:smartertools:smartermail:100.0.9378","cpe:2.3:a:smartertools:smartermail:100.0.9392","cpe:2.3:a:smartertools:smartermail:100.0.9399","cpe:2.3:a:smartertools:smartermail:100.0.9400","cpe:2.3:a:smartertools:smartermail:100.0.9406","cpe:2.3:a:smartertools:smartermail:100.0.9413","cpe:2.3:a:smartertools:smartermail:100.0.9420","cpe:2.3:a:smartertools:smartermail:100.0.9427","cpe:2.3:a:smartertools:smartermail:100.0.9434","cpe:2.3:a:smartertools:smartermail:100.0.9448","cpe:2.3:a:smartertools:smartermail:100.0.9455","cpe:2.3:a:smartertools:smartermail:100.0.9476","cpe:2.3:a:smartertools:smartermail:100.0.9483","cpe:2.3:a:smartertools:smartermail:100.0.9504","cpe:2.3:a:smartertools:smartermail:11.0.4807","cpe:2.3:a:smartertools:smartermail:11.0.4821","cpe:2.3:a:smartertools:smartermail:11.1.4842","cpe:2.3:a:smartertools:smartermail:11.2.4870","cpe:2.3:a:smartertools:smartermail:11.2.4871","cpe:2.3:a:smartertools:smartermail:11.3.4898","cpe:2.3:a:smartertools:smartermail:11.4.4926","cpe:2.3:a:smartertools:smartermail:11.5.4975","cpe:2.3:a:smartertools:smartermail:11.6.5010","cpe:2.3:a:smartertools:smartermail:11.6.5017","cpe:2.3:a:smartertools:smartermail:11.7.5066","cpe:2.3:a:smartertools:smartermail:11.7.5070","cpe:2.3:a:smartertools:smartermail:11.7.5091","cpe:2.3:a:smartertools:smartermail:11.7.5136","cpe:2.3:a:smartertools:smartermail:11.7.5157","cpe:2.3:a:smartertools:smartermail:11.7.5220","cpe:2.3:a:smartertools:smartermail:11.7.5318","cpe:2.3:a:smartertools:smartermail:12.0.5157","cpe:2.3:a:smartertools:smartermail:12.0.5171","cpe:2.3:a:smartertools:smartermail:12.0.5178","cpe:2.3:a:smartertools:smartermail:12.1.5224","cpe:2.3:a:smartertools:smartermail:12.2.5266","cpe:2.3:a:smartertools:smartermail:12.2.5269","cpe:2.3:a:smartertools:smartermail:12.2.5283","cpe:2.3:a:smartertools:smartermail:12.3.5308","cpe:2.3:a:smartertools:smartermail:12.4.5364","cpe:2.3:a:smartertools:smartermail:12.5.5409","cpe:2.3:a:smartertools:smartermail:13.0.5420","cpe:2.3:a:smartertools:smartermail:13.0.5430","cpe:2.3:a:smartertools:smartermail:13.2.5507","cpe:2.3:a:smartertools:smartermail:13.2.5511","cpe:2.3:a:smartertools:smartermail:13.3.5451","cpe:2.3:a:smartertools:smartermail:13.3.5535","cpe:2.3:a:smartertools:smartermail:13.4.5598","cpe:2.3:a:smartertools:smartermail:13.4.5603","cpe:2.3:a:smartertools:smartermail:13.5.5640","cpe:2.3:a:smartertools:smartermail:13.6.5703","cpe:2.3:a:smartertools:smartermail:14.0.5637","cpe:2.3:a:smartertools:smartermail:14.0.5647","cpe:2.3:a:smartertools:smartermail:14.0.5661","cpe:2.3:a:smartertools:smartermail:14.1.5675","cpe:2.3:a:smartertools:smartermail:14.2.5703","cpe:2.3:a:smartertools:smartermail:14.2.5704","cpe:2.3:a:smartertools:smartermail:14.2.5711","cpe:2.3:a:smartertools:smartermail:14.3.5752","cpe:2.3:a:smartertools:smartermail:14.4.5784","cpe:2.3:a:smartertools:smartermail:14.4.5787","cpe:2.3:a:smartertools:smartermail:14.4.5801","cpe:2.3:a:smartertools:smartermail:14.5.5871","cpe:2.3:a:smartertools:smartermail:14.6.5955","cpe:2.3:a:smartertools:smartermail:14.7.6081","cpe:2.3:a:smartertools:smartermail:14.7.6347","cpe:2.3:a:smartertools:smartermail:16.0.6345","cpe:2.3:a:smartertools:smartermail:16.0.6348","cpe:2.3:a:smartertools:smartermail:16.0.6362","cpe:2.3:a:smartertools:smartermail:16.0.6369","cpe:2.3:a:smartertools:smartermail:16.0.6376","cpe:2.3:a:smartertools:smartermail:16.0.6382","cpe:2.3:a:smartertools:smartermail:16.0.6390","cpe:2.3:a:smartertools:smartermail:16.0.6397","cpe:2.3:a:smartertools:smartermail:16.3.6663","cpe:2.3:a:smartertools:smartermail:16.3.6670","cpe:2.3:a:smartertools:smartermail:16.3.6677","cpe:2.3:a:smartertools:smartermail:16.3.6684","cpe:2.3:a:smartertools:smartermail:16.3.6691","cpe:2.3:a:smartertools:smartermail:16.3.6698","cpe:2.3:a:smartertools:smartermail:16.3.6705","cpe:2.3:a:smartertools:smartermail:16.3.6729","cpe:2.3:a:smartertools:smartermail:16.3.6733","cpe:2.3:a:smartertools:smartermail:16.3.6740","cpe:2.3:a:smartertools:smartermail:16.3.6744","cpe:2.3:a:smartertools:smartermail:16.3.6751","cpe:2.3:a:smartertools:smartermail:16.3.6754","cpe:2.3:a:smartertools:smartermail:16.3.6768","cpe:2.3:a:smartertools:smartermail:16.3.6775","cpe:2.3:a:smartertools:smartermail:16.3.6782","cpe:2.3:a:smartertools:smartermail:16.3.6795","cpe:2.3:a:smartertools:smartermail:16.3.6799","cpe:2.3:a:smartertools:smartermail:16.3.6802","cpe:2.3:a:smartertools:smartermail:16.3.6809","cpe:2.3:a:smartertools:smartermail:16.3.6816","cpe:2.3:a:smartertools:smartermail:16.3.6821","cpe:2.3:a:smartertools:smartermail:16.3.6830","cpe:2.3:a:smartertools:smartermail:16.3.6841","cpe:2.3:a:smartertools:smartermail:16.3.6843","cpe:2.3:a:smartertools:smartermail:16.3.6855","cpe:2.3:a:smartertools:smartermail:16.3.6870","cpe:2.3:a:smartertools:smartermail:16.3.6885","cpe:2.3:a:smartertools:smartermail:16.3.6893","cpe:2.3:a:smartertools:smartermail:16.3.6897","cpe:2.3:a:smartertools:smartermail:16.3.6915","cpe:2.3:a:smartertools:smartermail:16.3.6970","cpe:2.3:a:smartertools:smartermail:16.3.6989","cpe:2.3:a:smartertools:smartermail:16.3.7866","cpe:2.3:a:smartertools:smartermail:2.0.1713","cpe:2.3:a:smartertools:smartermail:2.0.1714","cpe:2.3:a:smartertools:smartermail:2.0.1721","cpe:2.3:a:smartertools:smartermail:2.0.1733","cpe:2.3:a:smartertools:smartermail:2.0.1754","cpe:2.3:a:smartertools:smartermail:2.0.1780","cpe:2.3:a:smartertools:smartermail:2.0.1797","cpe:2.3:a:smartertools:smartermail:2.0.1816","cpe:2.3:a:smartertools:smartermail:2.0.1837","cpe:2.3:a:smartertools:smartermail:2.3.2119","cpe:2.3:a:smartertools:smartermail:2.5.1874","cpe:2.3:a:smartertools:smartermail:2.6.1921","cpe:2.3:a:smartertools:smartermail:2.6.2004","cpe:2.3:a:smartertools:smartermail:2.6.2012","cpe:2.3:a:smartertools:smartermail:2.6.2167","cpe:2.3:a:smartertools:smartermail:3.0.2231","cpe:2.3:a:smartertools:smartermail:3.0.2242","cpe:2.3:a:smartertools:smartermail:3.0.2249","cpe:2.3:a:smartertools:smartermail:3.1.2298","cpe:2.3:a:smartertools:smartermail:3.1.2305","cpe:2.3:a:smartertools:smartermail:3.2.2327","cpe:2.3:a:smartertools:smartermail:3.3.2369","cpe:2.3:a:smartertools:smartermail:3.3.2439","cpe:2.3:a:smartertools:smartermail:3.3.2543","cpe:2.3:a:smartertools:smartermail:3.3.2621","cpe:2.3:a:smartertools:smartermail:4.0.2566","cpe:2.3:a:smartertools:smartermail:4.0.2581","cpe:2.3:a:smartertools:smartermail:4.0.2592","cpe:2.3:a:smartertools:smartermail:4.1.2634","cpe:2.3:a:smartertools:smartermail:4.2.2693","cpe:2.3:a:smartertools:smartermail:4.2.2698","cpe:2.3:a:smartertools:smartermail:4.3.2739","cpe:2.3:a:smartertools:smartermail:4.3.2760","cpe:2.3:a:smartertools:smartermail:4.3.2830","cpe:2.3:a:smartertools:smartermail:4.3.2831","cpe:2.3:a:smartertools:smartermail:4.3.2903","cpe:2.3:a:smartertools:smartermail:4.3.2981","cpe:2.3:a:smartertools:smartermail:4.3.3048","cpe:2.3:a:smartertools:smartermail:5.0.2994","cpe:2.3:a:smartertools:smartermail:5.0.2999","cpe:2.3:a:smartertools:smartermail:5.1.3047","cpe:2.3:a:smartertools:smartermail:5.1.3051","cpe:2.3:a:smartertools:smartermail:5.5.3126","cpe:2.3:a:smartertools:smartermail:5.5.3159","cpe:2.3:a:smartertools:smartermail:5.5.3216","cpe:2.3:a:smartertools:smartermail:5.5.3217","cpe:2.3:a:smartertools:smartermail:5.5.3223","cpe:2.3:a:smartertools:smartermail:5.5.3315","cpe:2.3:a:smartertools:smartermail:5.5.3316","cpe:2.3:a:smartertools:smartermail:5.5.3317","cpe:2.3:a:smartertools:smartermail:5.5.3348","cpe:2.3:a:smartertools:smartermail:5.5.3362","cpe:2.3:a:smartertools:smartermail:6.0.3508","cpe:2.3:a:smartertools:smartermail:6.1.3518","cpe:2.3:a:smartertools:smartermail:6.5.3586","cpe:2.3:a:smartertools:smartermail:6.6.3636","cpe:2.3:a:smartertools:smartermail:6.7.3701","cpe:2.3:a:smartertools:smartermail:6.8.3750","cpe:2.3:a:smartertools:smartermail:6.9.3820","cpe:2.3:a:smartertools:smartermail:6.9.3953","cpe:2.3:a:smartertools:smartermail:7.0.3845","cpe:2.3:a:smartertools:smartermail:7.0.3862","cpe:2.3:a:smartertools:smartermail:7.1.3876","cpe:2.3:a:smartertools:smartermail:7.2.3925","cpe:2.3:a:smartertools:smartermail:7.3.3952","cpe:2.3:a:smartertools:smartermail:7.4.3995","cpe:2.3:a:smartertools:smartermail:7.5.4072","cpe:2.3:a:smartertools:smartermail:7.5.4079","cpe:2.3:a:smartertools:smartermail:7.6.4100","cpe:2.3:a:smartertools:smartermail:8.0.4079","cpe:2.3:a:smartertools:smartermail:8.0.4080","cpe:2.3:a:smartertools:smartermail:8.0.4083","cpe:2.3:a:smartertools:smartermail:8.0.4086","cpe:2.3:a:smartertools:smartermail:8.1.4170","cpe:2.3:a:smartertools:smartermail:8.2.4212","cpe:2.3:a:smartertools:smartermail:8.3.4296","cpe:2.3:a:smartertools:smartermail:8.3.4310","cpe:2.3:a:smartertools:smartermail:8.4.4331","cpe:2.3:a:smartertools:smartermail:8.4.4359","cpe:2.3:a:smartertools:smartermail:9.0.4394","cpe:2.3:a:smartertools:smartermail:9.0.4395","cpe:2.3:a:smartertools:smartermail:9.0.4401","cpe:2.3:a:smartertools:smartermail:9.0.4408","cpe:2.3:a:smartertools:smartermail:9.1.4429","cpe:2.3:a:smartertools:smartermail:9.2","cpe:2.3:a:smartertools:smartermail:9.2.4450","cpe:2.3:a:smartertools:smartermail:9.2.4464","cpe:2.3:a:smartertools:smartermail:9.2.4469","cpe:2.3:a:smartertools:smartermail:9.3.4499","cpe:2.3:a:smartertools:smartermail:9.3.4513","cpe:2.3:a:smartertools:smartermail:9.4.4548","cpe:2.3:a:smartertools:smartermail:9.4.4609"]}