CVE-2026-113598 — Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bul…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7