CVE-2026-113598
MediumCVSS 4.3Summary
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
Risk Assessment
Integrity and availability breach — deleting alarms can hide critical DNS, MX, or blocklist configuration issues, leading to unnoticed failures or security gaps. This may result in service disruptions and delayed incident response.
Recommendation
Update Modoboa to version 2.8.0 or later. In the meantime, consider restricting access to the alarm deletion API and implementing monitoring of alarm changes.
Other vulnerabilities in Modoboa
See all- CVE-2026-113599Medium
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.
- CVE-2026-56780High
Modoboa before version 2.9.0 has an insecure direct object reference (IDOR) vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint. Domain administrators can change any user's password, including superadmins, leading to full account takeover.
Original NVD description (English source)
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS