Modoboa versions before 2.9.0 contain an insecure direct object reference vulnerability in the password reset API endpoint. This flaw allows domain administrators to bypass object-level access controls and change any user's password, including superadmin accounts, potentially leading to full account takeover.