CVE-2026-113599
Received Received - Intake

Insecure Direct Object Reference in Modoboa Auto-Reply Messages

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113599
EUVD
EUVD-2026-105165

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
modoboa modoboa 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Modoboa before version 2.8.0 has an Insecure Direct Object Reference (IDOR) vulnerability in its API v2 armessages endpoint. Authenticated users can exploit this by manipulating the mbox parameter to create auto-reply messages for other users' mailboxes. Attackers can inject malicious or unwanted auto-reply content into victims' settings or disrupt auto-reply functionality by causing MultipleObjectsReturned errors.

Detection Guidance

Check Modoboa API logs for POST requests to /api/v2/armessages/ with manipulated mbox parameters. Look for MultipleObjectsReturned errors in logs. Verify if users report unexpected auto-reply messages or settings changes.

Impact Analysis

If you use Modoboa before version 2.8.0, an attacker with valid credentials could modify your auto-reply settings without permission. This could lead to unwanted messages being sent from your account, potential disruption of your email auto-reply functionality, or exposure to malicious content injected into your settings.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to user settings, potentially violating data integrity and access control requirements under GDPR and HIPAA. Unauthorized auto-reply content injection may also lead to unintended data exposure or misuse of user accounts.

Mitigation Strategies

Upgrade Modoboa to version 2.8.0 or later. Review API access logs for suspicious activity. Restrict API endpoint access to authorized users only. Monitor for unauthorized auto-reply modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113599. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart