CVE-2026-113599 modoboa CVE debrief

Who should care

Defenders responsible for Modoboa installations, particularly those using versions before 2.8.0, should assess exposure and implement the patch provided in version 2.8.0. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, assess potential impact, and apply the patch to prevent unauthorized creation of auto-reply messages.

Why it matters

CVE-2026-113599 is a medium-severity vulnerability in Modoboa before 2.8.0 that allows authenticated users to create auto-reply messages for arbitrary mailboxes. Defenders should verify exposure, assess impact, and implement the patch provided in version 2.8.0.

• Potential unauthorized creation of auto-reply messages for arbitrary mailboxes.
• Possible disruption of auto-reply management for victims' settings.
• Potential for attackers to inject malicious content into auto-replies.

Technical summary

The vulnerability allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value in the API v2 armessages endpoint. This can be exploited by POSTing to /api/v2/armessages/ with attacker-controlled auto-reply subject and content. The vulnerability has a medium severity and defenders should assess exposure and implement the patch provided in version 2.8.0. Technical details are limited to CVE and source item information, suggesting a focus on defensive actions and patch implementation.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly those using Modoboa for email management.

Recommended defensive actions

• Verify the version of Modoboa being used and assess exposure to this vulnerability.
• Implement the patch provided in Modoboa version 2.8.0.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is described in the CVE record and source item from the CVE Program cvelistV5. The Modoboa project has released a patch in version 2.8.0. Evidence is limited to public CVE details and vendor advisory information. Defenders should verify exposure using official CVE and vendor information, assess potential impact on their systems, and implement the patch provided in Modoboa version 2.8.0. Limited source detail suggests cautious verification of affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.