Live › vulnerability › CVE-2026-113599
Go to dashboardModoboa before 2.8.0 has an insecure direct object reference in its auto-reply API: an authenticated user can post to /api/v2/armessages/ with another user's mbox value. An attacker can inject their own auto-reply subject and content into a victim's mailbox settings, or break the victim's auto-reply management with MultipleObjectsReturned errors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Modoboa installations before 2.8.0 where users hold accounts that can reach the auto-reply API. Exposure comes from any authenticated mail user, so the risk is greatest on multi-tenant or self-service mail servers. Single-admin installs with no other users have little exposure.
No product ranges from the sources yet.
pip show modoboa or the version in the deployment's requirements) and see whether it is below 2.8.0.POST /api/v2/armessages/ on the Modoboa host.2.8.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.
This page as .md · .json · in your agent: get_signal("CVE-2026-113599")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.