CVE-2026-113599 Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Medium 5.3 Published 20 Oct 2026 Updated 20 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-113599?

CVE-2026-113599 is a medium-severity vulnerability in modoboa, published on 20 Oct 2026.

Official description

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.

Weakness: CWE-639

Which versions are affected by CVE-2026-113599?

How do I fix CVE-2026-113599?

No fix has been published for CVE-2026-113599 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-113599 being exploited?

There is no known exploitation of CVE-2026-113599 in the wild and no public exploit code.

Sources

Also known as GHSA-rg3x-36vj-2j2w.