CVE-2026-113599 is a vulnerability in Modoboa before version 2.8.0 that allows authenticated users to create auto-reply messages for arbitrary mailboxes via an insecure direct object reference (IDOR) vulnerability in the API v2 armessages endpoint. This vulnerability can be exploited by supplying another user's mbox value, potentially leading to unauthorized creation of auto-reply messages and disruption [truncated]
CVE-2026-113598 is a vulnerability in Modoboa before version 2.8.0 that allows authenticated users to delete alarms of other domains via the API v2 alarms bulk_delete action. This insecure direct object reference (IDOR) vulnerability can lead to unauthorized deletion of alarms, potentially hiding problems from administrators. Defenders responsible for Modoboa instances, particularly those with multiple do [truncated]
