CVE-2026-56780
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Modoboa before version 2.9.0 has an insecure direct object reference (IDOR) vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint. Domain administrators can change any user's password, including superadmins, leading to full account takeover.
Risk Assessment
The risk for the organization includes privilege escalation by domain administrators who can take over superadmin accounts and gain unauthorized access to the entire Modoboa system, potentially compromising data confidentiality and integrity.
Recommendation
Immediately upgrade Modoboa to version 2.9.0 or later, which includes a fix for the IDOR vulnerability. Additionally, review domain administrator permissions and implement object-level access controls.
Other vulnerabilities in Modoboa
See all- CVE-2026-113599Medium
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.
- CVE-2026-113598Medium
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
Original NVD description (English source)
Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS