CyberSecBulletin

Modoboa vulnerabilities

We track 2 vulnerabilities in Modoboa products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on June 29, 2026.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest Modoboa vulnerabilities

  • 7.5 High severity

    modoboa: Authorization Bypass Through User-Controlled Key

    CVE-2026-56780Modoboa

    Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level

  • 7.2 High severity

    modoboa: Improper Neutralization of Special Elements used in an OS Command

    CVE-2026-27602Modoboa

    Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reselle