CVE-2026-113598

Deferred Deferred - Pending Action

Authenticated Users Can Delete Alarms in Modoboa via Insecure Direct Object Reference

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113598

EUVD

EUVD-2026-105164

Affected Vendors & Products

Vendor	Product	Version / Range
modoboa	modoboa	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-113598 is an Insecure Direct Object Reference (IDOR) vulnerability in Modoboa versions before 2.8.0. It allows authenticated users to delete alarms belonging to other domains by exploiting sequential alarm IDs through the POST /api/v2/alarms/bulk_delete/ endpoint. Attackers can enumerate these IDs to delete critical monitoring alarms like DNS, MX, and blocklist alerts, hiding issues from administrators.

Detection Guidance

Check Modoboa version with: pip show modoboa. If version is below 2.8.0, the system is vulnerable. Review API logs for POST requests to /api/v2/alarms/bulk_delete/ with sequential alarm IDs. Monitor for unauthorized alarm deletions across domains.

Impact Analysis

This vulnerability allows attackers with valid credentials to delete important monitoring alarms across all domains. This could hide security issues like DNS or MX failures, blocklist violations, or other critical problems from administrators. It may lead to undetected service disruptions, security breaches going unnoticed, or unauthorized changes to email infrastructure.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized deletion of monitoring alarms, potentially concealing security incidents or data integrity issues. For GDPR, this may affect breach detection and accountability. For HIPAA, it could compromise monitoring of protected health information systems.

Mitigation Strategies

Upgrade Modoboa to version 2.8.0 or later immediately. Review and restrict API permissions to ensure only authorized users can access alarm deletion endpoints. Implement additional logging for API v2 alarm actions to detect suspicious activity.

Hi! I’m here to help you understand CVE-2026-113598. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...