Read the docs

modoboa

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

modoboa records in CISA KEV

No modoboa vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Modoboa 14 records HIGH Installer 1 record HIGH Modoboa-dmarc 1 record LOW

Records

19 records

TI-2023-02089 CVE-2023-2227 · GHSA-67mg-gm8m-ph5r

Improper Authorization in modoboa/modoboa

Priority HIGH 80

Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.43756 Published 2023-04-21 Fixed in 2.1.0 CWE-285
TI-2023-05233 CVE-2023-5690 · GHSA-57cr-rq3f-ppmx

Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Priority HIGH 77

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00512 Published 2023-10-20 Fixed in 2.2.2 CWE-352
TI-2023-02028 CVE-2023-2160 · GHSA-9gxx-32p7-ff7m

Weak Password Requirements in modoboa/modoboa

Priority HIGH 75

Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00619 Published 2023-04-18 Fixed in 2.1.0 CWE-521
TI-2026-21988 CVE-2026-27602 · GHSA-wwv8-cqpr-vx3m

Modoboa has an OS Command Injection

Priority HIGH 67

Modoboa is a mail hosting and management platform.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00576 Published 2026-03-25 Fixed in 2.7.1 CWE-78
TI-2023-05231 CVE-2023-5688 · GHSA-pqgm-9g82-wcm7

Cross-site Scripting (XSS) - DOM in modoboa/modoboa

Priority HIGH 66

Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00655 Published 2023-10-20 Fixed in 2.2.2 CWE-79
TI-2023-02090 CVE-2023-2228 · GHSA-6pvf-cq4f-hfjp

Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Priority HIGH 65

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00378 Published 2023-04-21 Fixed in 2.1.0 CWE-352
TI-2023-00415 CVE-2023-0438 · GHSA-9c64-x3cx-vgmm

Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Priority MEDIUM 62

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00352 Published 2023-01-23 Fixed in 2.0.4 CWE-352
TI-2023-00379 CVE-2023-0398 · GHSA-v9gj-5rgp-w33r

Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Priority MEDIUM 62

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00358 Published 2023-01-19 Fixed in 2.0.4 CWE-352
TI-2023-05232 CVE-2023-5689 · GHSA-9wj3-cfq8-wpvj

Cross-site Scripting (XSS) - DOM in modoboa/modoboa

Priority MEDIUM 60

Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00602 Published 2023-10-20 Fixed in 2.2.2 CWE-79
TI-2023-00491 CVE-2023-0519 · GHSA-jm3m-wr3p-hjrq

Cross-site Scripting (XSS) - Stored in modoboa/modoboa

Priority MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00512 Published 2023-01-26 Fixed in 2.0.4 CWE-79
TI-2023-00445 CVE-2023-0470 · GHSA-c467-5c2g-jp86

Cross-site Scripting (XSS) - Stored in modoboa/modoboa

Priority MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00631 Published 2023-01-26 Fixed in 2.0.4 CWE-79
TI-2023-00387 CVE-2023-0406 · GHSA-g298-59pg-93h7

Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Priority MEDIUM 53

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00397 Published 2023-01-19 Fixed in 2.0.4 CWE-352
TI-2026-40944 CVE-2026-56780 · GHSA-c3qp-4qxm-fwhr

Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API

Priority LOW 36

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00455 Published 2026-06-29 Fixed in 2.9.0 CWE-639
TI-2026-76928 CVE-2026-113599 · GHSA-rg3x-36vj-2j2w

Insecure direct object reference in Modoboa API auto-reply creation

Priority LOW 24

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0034 Published 2026-10-20 Fixed in 2.8.0 CWE-639
TI-2026-76927 CVE-2026-113598 · GHSA-cq85-78wv-p3mx

Insecure direct object reference in Modoboa alarm bulk deletion

Priority LOW 24

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00301 Published 2026-10-20 Fixed in 2.8.0 CWE-639
Open these records in search →