Live › vulnerability › CVE-2026-113598
Go to dashboardModoboa before 2.8.0 lets any authenticated user delete monitoring alarms belonging to other domains through the POST /api/v2/alarms/bulk_delete/ endpoint. An attacker can enumerate sequential alarm IDs to wipe DNS, MX and blocklist alarms server-wide, hiding problems from administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of Modoboa before 2.8.0 with more than one authenticated user, such as hosting providers or multi-domain mail servers where domain admins hold accounts. Single-admin installations have less exposure because the flaw requires an authenticated user who should not see other domains' alarms.
No product ranges from the sources yet.
pip show modoboa or the deployed package) and see whether it is below 2.8.02.8.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-113598")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.