CVE-2026-113598 modoboa CVE debrief

Who should care

Defenders responsible for Modoboa instances, particularly those with multiple domains and alarm monitoring, should assess exposure and apply the patch to prevent unauthorized deletion of alarms.

Why it matters

CVE-2026-113598 is a medium-severity vulnerability in Modoboa before version 2.8.0 that allows authenticated users to delete alarms of other domains via the API v2 alarms bulk_delete action, potentially hiding problems from administrators.

• Defenders need to verify exposure and apply the patch to prevent unauthorized deletion of alarms.
• The vulnerability allows for potential hiding of problems from administrators, impacting monitoring and incident response.
• Defenders should restrict access to the API v2 alarms bulk_delete action to authorized users only.

Technical summary

The vulnerability is an insecure direct object reference (IDOR) in Modoboa before version 2.8.0 that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. This vulnerability can be exploited by enumerating sequential alarm IDs to delete DNS, MX, and blocklist monitoring alarms server-wide, potentially hiding problems from responsible administrators. The vulnerability has a medium severity with a CVSS score of 5.3 and is described in the CVE record and source item from cve_program_cvelist_v5.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for unauthorized deletion of alarms, potentially hiding problems from administrators.

Recommended defensive actions

• Verify if the Modoboa instance is running a version before 2.8.0 and apply the patch to prevent unauthorized deletion of alarms.
• Restrict access to the API v2 alarms bulk_delete action to authorized users only.
• Monitor for suspicious activity related to alarm deletion.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is described in the CVE record and source item from cve_program_cvelist_v5. The source item provides additional details about the vulnerability, including references to issue-tracking, patch, release-notes, technical-description, and third-party-advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.