modoboa vulnerabilities

CVEs whose affected-version data names the modoboa package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

4 CVEsRSS

CVE-2026-113598Medium· 4.3

1w ago

Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm I…

▾ Sunlitmodoboa · modoboaEPSS 0.30%via CVEORG

CVE-2026-113599Medium· 5.4

1w ago

Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/a…

▾ Sunlitmodoboa · modoboaEPSS 0.34%via CVEORG

CVE-2026-27602High· 7.2

7mo ago

Modoboa has OS Command Injection

▾ Twilightmodoboa · modoboaEPSS 0.58%via OSV

CVE-2023-0860High· 7.5PoC

3y ago

Improper Restriction of Excessive Authentication Attempts in modoboa

▾ Midnightmodoboa · modoboaEPSS 0.66%via OSV