Modoboa EUVD-2026-105165

Requires an authenticated, low-privileged account with a valid mailbox on the target Modoboa instance (PR:L) - any ordinary mail user suffices; no admin role is needed. The specific prerequisite is access to the /api/v2/armessages/ REST endpoint while running a version before 2.8.0, whose autoreply serializer lacked a validate_mbox ownership check, allowing the client-supplied mbox field to reference another user's mailbox. No special non-default configuration or user interaction is required. The key limiting factors are: the attacker must already hold valid credentials (not exploitable by unauthenticated attackers), and impact is confined to tampering with or disrupting auto-reply settings - there is no data disclosure or privilege escalation.

This is a medium-severity authorization flaw (CWE-639 IDOR), and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) and score of 5.3 align well with the description: network-reachable API, low attack complexity, but requiring an authenticated low-privileged account (PR:L), with no confidentiality loss and only limited integrity and availability impact. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' The ceiling on impact is genuinely low: an attacker cannot read victim data (VC:N), only tamper with a victim's auto-reply message (integrity) or disrupt their auto-reply management (availability via MultipleObjectsReturned errors). This is a legitimate bug to patch but is not an emergency 'drop everything' issue; it is best characterized as a real but bounded, authenticated-only integrity/availability problem rather than a high-real-risk issue, and the low deployment footprint of Modoboa further reduces aggregate risk. The source-code diff confirms the root cause (a missing validate_mbox ownership check in the autoreply serializer), which independently corroborates the description and raises confidence in the technical assessment.

A legitimate low-privileged mailbox user on a shared Modoboa instance sends a crafted POST to /api/v2/armessages/ specifying another user's mbox value instead of their own. Because the pre-2.8.0 serializer never verified mailbox ownership, the server creates or alters the victim's auto-reply, letting the attacker inject attacker-controlled subject/content or break the victim's auto-reply management via MultipleObjectsReturned errors. No public exploit code was identified in the input, but the flaw is trivially reproducible given a valid account and the documented endpoint.