CVE-2026-113598

MEDIUM 4.3

Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.

CWE	CWE-639
Vendor	modoboa
Product	modoboa
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for modoboa modoboa

Be the first to know when new medium vulnerabilities affecting modoboa modoboa are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

modoboa / modoboa

0 < 2.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/modoboa/modoboa/issues/3945 github.com: https://github.com/modoboa/modoboa/commit/e0a4e3b9ee8ad84dba46e4c0f04cbbe7cf78c38d github.com: https://github.com/modoboa/modoboa/releases/tag/2.8.0 github.com: https://github.com/modoboa/modoboa/blob/2.7.2/modoboa/admin/api/v2/viewsets.py vulncheck.com: https://www.vulncheck.com/advisories/modoboa-before-2.8.0-idor-via-api-v2-alarms-bulk-delete

Credits

lighthousekeeper1212 🔍 leediay153 from Viettel Post