1name: crowdsecurity/vpatch-WT-2026-0001
2description: "Detects authentication bypass in SmarterTools SmarterMail via force-reset-password endpoint when IsSysAdmin is true"
3rules:
4  - and:
5      - zones:
6          - URI
7        transform:
8          - urldecode
9          - lowercase
10        match:
11          type: contains
12          value: "/api/v1/auth/force-reset-password"
13      - zones:
14          - BODY_ARGS
15        variables:
16          - json.issysadmin
17        transform:
18          - lowercase
19        match:
20          type: equals
21          value: "true"
22
23labels:
24  type: exploit
25  service: http
26  confidence: 3
27  spoofable: 0
28  behavior: "http:exploit"
29  label: "SmarterMail - Authentication Bypass"
30  classification:
31    - cve.CVE-2026-23760
32    - attack.T1190
33    - cwe.CWE-287
34