CVE-2026-113598
CVE-2026-113598 · Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
CVSS 5.3 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
modoboa
- Versiones
- ≥ 0, < 2.8.0: Afectada (semver)
Actualiza a 2.8.0
Fuentes originales
- https://github.com/modoboa/modoboa/issues/3945
- https://github.com/modoboa/modoboa/commit/e0a4e3b9ee8ad84dba46e4c0f04cbbe7cf78c38d
- https://github.com/modoboa/modoboa/releases/tag/2.8.0
- https://github.com/modoboa/modoboa/blob/2.7.2/modoboa/admin/api/v2/viewsets.py
- https://www.vulncheck.com/advisories/modoboa-before-2.8.0-idor-via-api-v2-alarms-bulk-delete
- https://nvd.nist.gov/vuln/detail/CVE-2026-113598