CVE-2026-113598
CVE-2026-113598 · Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
CVSS 5.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
modoboa
- Versions
- ≥ 0, < 2.8.0: Affected (semver)
Update to 2.8.0
Original sources
- https://github.com/modoboa/modoboa/issues/3945
- https://github.com/modoboa/modoboa/commit/e0a4e3b9ee8ad84dba46e4c0f04cbbe7cf78c38d
- https://github.com/modoboa/modoboa/releases/tag/2.8.0
- https://github.com/modoboa/modoboa/blob/2.7.2/modoboa/admin/api/v2/viewsets.py
- https://www.vulncheck.com/advisories/modoboa-before-2.8.0-idor-via-api-v2-alarms-bulk-delete
- https://nvd.nist.gov/vuln/detail/CVE-2026-113598