Insecure Direct Object Reference in Modoboa Email Management

CVE-2026-113599

What is CVE-2026-113599?

Modoboa, the open-source email management platform, has a vulnerability that permits authenticated users to exploit insecure direct object references. This allows attackers to manipulate auto-reply settings, creating unauthorized messages for other users’ mailboxes by exploiting the system’s API. Through a POST request to /api/v2/armessages/, attackers can inject unwanted content into victims' settings or disrupt their auto-reply configurations, leading to potential misuse of the email management system.

References