The vulnerability lies in an authentication bypass in the password reset API, where the force-reset-password endpoint accepts requests without verifying existing credentials or a reset token when targeting system administrator accounts. An attacker can supply an administrator username and a new password, effectively resetting the administrator account and gaining full administrative control of the SmarterMail instance. This control enables execution of operating system commands through built‑in management features, offering system‑level access. The weakness is classified as CWE‑288.

SmarterTools SmarterMail versions earlier than build 9511 are affected. The vulnerability applies to all installations that expose the password reset endpoint to unauthenticated users.

With a CVSS score of 9.3 and an EPSS score of 80 %, the likelihood of exploitation is high. The vulnerability is listed in the CISA KEV catalog, indicating that attacks are actively observed. Because the endpoint permits anonymous requests, the likely attack vector is network‑based or local to the host, depending on exposure of the API.