Modoboa CVE-2026-113598

Requires a valid authenticated Modoboa account of any privilege level (PR:L); the flaw is in the POST /api/v2/alarms/bulk_delete/ endpoint, which prior to 2.8.0 deleted any alarm by primary key without scoping to the caller's permitted domains. No special configuration, user interaction, or administrative role is needed - it works against default deployments of Modoboa before 2.8.0. The only limiting factor is that the attacker must first hold credentials for some account on the instance; the impact is confined to deletion of monitoring alarms (DNS/MX/blocklist), with no read access to other tenants' data and no direct availability loss to mail services.

This is a genuine but moderate-severity authorization flaw, not a high-urgency emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 5.3 (Medium), and the signals are internally consistent: network-reachable API, low attack complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only limited integrity impact (VI:L) with no confidentiality or availability loss. The source-code evidence confirms the root cause - the bulk_delete handler called models.Alarm.objects.filter(...) across all objects instead of self.get_queryset(), so tenant scoping was absent. No EPSS score was provided, the CVE is not on CISA KEV, and no POC flag was set, so exploitation status is 'no public exploit identified at time of analysis.' The real-world risk is tempered by three facts: an attacker must already hold a valid authenticated account, the impact is destruction of monitoring alarms (an integrity/visibility harm) rather than data theft or server compromise, and the product footprint is small. The notable risk is stealth: deleting DNS/MX/blocklist alarms server-wide could mask a concurrent mail-delivery or reputation problem from administrators, making this more valuable as a cover-your-tracks step than as a standalone attack.

A user with a low-privileged authenticated account on one Modoboa-hosted domain scripts requests to POST /api/v2/alarms/bulk_delete/ with sequentially enumerated alarm IDs. Because the endpoint filtered across all Alarm objects rather than the caller's queryset, the deletions succeed across every domain, wiping DNS, MX, and blocklist monitoring alarms server-wide and hiding active problems from the administrators responsible for them. No public exploit code is identified, but the source diff makes the one-line flaw and exploitation path trivial to reproduce.