CVE-2026-113599
MediumCVSS 5.4Summary
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.
Risk Assessment
Integrity and confidentiality breach — attackers can modify victims' auto-reply settings, potentially leading to phishing or information disclosure. It may also disrupt email communication.
Recommendation
Update Modoboa to version 2.8.0 or later. Additionally, monitoring for unusual changes in auto-reply settings is recommended.
Other vulnerabilities in Modoboa
See all- CVE-2026-113598Medium
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
- CVE-2026-56780High
Modoboa before version 2.9.0 has an insecure direct object reference (IDOR) vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint. Domain administrators can change any user's password, including superadmins, leading to full account takeover.
Original NVD description (English source)
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS