Insecure Direct Object Reference in Modoboa by Modoboa

CVE-2026-113598

What is CVE-2026-113598?

An insecure direct object reference vulnerability exists in Modoboa prior to version 2.8.0, allowing authenticated users to exploit the POST /api/v2/alarms/bulk_delete/ action. By leveraging this flaw, attackers can sequentially enumerate alarm IDs to delete critical monitoring alarms, including DNS, MX, and blocklist notifications across multiple domains. This can lead to significant operational issues as it allows unauthorized users to obscure alarm statuses from the system administrators, thus hindering proper monitoring and response to domain-related issues.

References