# Huntress Catches SmarterMail Account Takeover Leading to RCE

SmarterMail's force-reset-password endpoint failed to validate the old password, letting attackers reset privileged accounts and chain System Events to RCE.

- Payout: Real-world hack
- Severity: critical
- Program: SmarterMail
- Credited: Huntress
- Disclosed: 2026-01-22
- CVE: CVE-2026-23760
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smartermail-account-takeover-leading-to-rce
- Tags: domain:web impact:ato impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical technique:incomplete-fix technique:source-review vuln:account-takeover vuln:auth-bypass vuln:rce

**Target:** SmarterMail web API (/api/v1/auth/force-reset-password)
**Root cause:** The /api/v1/auth/force-reset-password endpoint did not verify that the submitted old password was valid, allowing a privileged user's password to be changed without authentication.
**Steps:**
1. `POST /api/v1/auth/force-reset-password` with target privileged account and new password (old password not validated)
2. `POST /api/v1/auth/authenticate-user` with the new credentials to obtain an access token
3. `POST /api/v1/settings/sysadmin/event-hook` to create a malicious System Event executing a recon command on domain add
4. `POST /api/v1/settings/sysadmin/domain-put` to add a domain and trigger the event
5. `POST /api/v1/settings/sysadmin/domain-delete/google.abc[.]com/true` and `POST /api/v1/settings/sysadmin/event-hook-delete` to clean up
**How found:** Huntress diffed SmarterMail builds 9504 and 9511, spotting the added check validating the old password in force-reset-password; they then built a working exploit confirming unauthenticated privileged password change.
**Exploitation:** Attacker sends unauthenticated force-reset-password to hijack a privileged account, authenticates to get a token, registers a System Event hook that runs commands when a domain is added, adds a domain to trigger execution, then deletes the domain and hook to remove indicators. Output written to result.txt in wwwroot.
**Escalation:** Account takeover of privileged user chained to System Event command execution, yielding RCE on the mail server.
**Insight:** Diff consecutive vendor builds around a patch date and look for newly added validation on password/reset endpoints; a missing old-password check on a force-reset route is a direct privileged ATO primitive.