CVE-2026-113599 — Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplyin…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7