modoboa has 4 CVEs on record between 2023 and 2026. 2 were published in the last 90 days. The median CVSS is 6.3 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Weakness classes
Products
- modoboa 4
Worst active — by depth score
CVE-2023-0860High· 7.5Improper Restriction of Excessive Authentication Attempts in modoboa53CVE-2026-27602High· 7.2Modoboa has OS Command Injection40CVE-2026-113599Medium· 5.4Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation30CVE-2026-113598Medium· 4.3Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete24
modoboa vulnerabilities
CVEs affecting modoboa, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-113598Medium· 4.3Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm I…
CVE-2026-113599Medium· 5.4Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/a…
CVE-2026-27602High· 7.2Modoboa has OS Command Injection
Modoboa has OS Command Injection
CVE-2023-0860High· 7.5PoCImproper Restriction of Excessive Authentication Attempts in modoboa
Improper Restriction of Excessive Authentication Attempts in modoboa