Modoboa Modoboa vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Modoboa Modoboa: 2 record(s), with affected versions and fixes.
cpe:2.3:a:modoboa:modoboa

CVE-2026-56780 High · 7.5 CWE-639 Jun 29, 2026

Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.

CVE-2026-27602 High · 7.2 CWE-78 Mar 25, 2026

Modoboa has an OS Command Injection

Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.