Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete

Advisories

Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete

Severity: medium
Date: 10/20/2026
Affecting: modoboa >= 0, < 2.8.0
CVE: CVE-2026-113598
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://github.com/modoboa/modoboa/issues/3945
https://github.com/modoboa/modoboa/commit/e0a4e3b9ee8ad84dba46e4c0f04cbbe7cf78c38d
modoboa 2.8.0 Release Notes
https://github.com/modoboa/modoboa/blob/2.7.2/modoboa/admin/api/v2/viewsets.py
Credit: lighthousekeeper1212, leediay153 from Viettel Post
Description: Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo