Vulners
Lucene search
CVE-2026-23760
🗓️ 22 Jan 2026 14:35:17Reported by VulnCheckType 
cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 50 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 24 |
|---|---|---|---|---|
 | Exploit for CVE-2026-23760 | 24 Jan 202612:30 | – | githubexploit |
 | CVE-2026-23760 | 22 Jan 202614:35 | – | attackerkb |
 | CVE-2026-23760 | 22 Jan 202615:50 | – | circl |
 | SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability | 26 Jan 202600:00 | – | cisa_kev |
 | CISA Adds Five Known Exploited Vulnerabilities to Catalog | 26 Jan 202612:00 | – | cisa |
 | SmarterTools SmarterMail security vulnerability | 22 Jan 202600:00 | – | cnnvd |
 | CVE-2026-23760 SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API | 22 Jan 202614:35 | – | cvelist |
 | EUVD-2026-4143 | 22 Jan 202614:35 | – | euvd |
 | Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations | 6 Apr 202616:00 | – | mssecure |
 | Vulnerability fixed in SmarterTools SmarterMail | 6 Feb 202609:25 | – | ncsc |
10
Node
[
{
"defaultStatus": "unaffected",
"product": "SmarterMail",
"vendor": "SmarterTools",
"versions": [
{
"lessThan": "100.0.9511",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| IsSysAdmin | request body | /api/v1/auth/force-reset-password | Authentication bypass via password reset API allowing admin account takeover | CWE-288 |
| OldPassword | request body | /api/v1/auth/force-reset-password | Authentication bypass via password reset API allowing admin account takeover | CWE-288 |
| Username | request body | /api/v1/auth/force-reset-password | Authentication bypass via password reset API allowing admin account takeover | CWE-288 |
| NewPassword | request body | /api/v1/auth/force-reset-password | Authentication bypass via password reset API allowing admin account takeover | CWE-288 |
| ConfirmPassword | request body | /api/v1/auth/force-reset-password | Authentication bypass via password reset API allowing admin account takeover | CWE-288 |
10
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
05 Mar 2026 01:30Current
6.3Medium risk
Vulners AI Score6.3
CVSS 3.19.8
CVSS 49.3
EPSS0.81651
SSVC