Skip to content
OpenAdvisories

Vendor

modoboa

18 known vulnerabilities.

Products

modoboa/modoboa 13 modoboa 4 modoboa/modoboa-installer 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-56780

    Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API

    Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level…

    modoboa modoboa
  • High 7.2
    CVE-2026-27602

    Modoboa has an OS Command Injection

    Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Resell…

    modoboa modoboa modoboa PyPI
  • High 7.1
    CVE-2023-5689

    Cross-site Scripting (XSS) - DOM in modoboa/modoboa

    Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.

    modoboa modoboa/modoboa modoboa PyPI
  • High 7.8
    CVE-2023-0860 Public exploit

    Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer

    Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.

    modoboa modoboa/modoboa-installer modoboa PyPI
  • High 8.6
    CVE-2023-0777 Public exploit EPSS 15%

    Authentication Bypass by Primary Weakness in modoboa/modoboa

    Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.

    modoboa modoboa/modoboa modoboa PyPI
  • High 7.1
    CVE-2023-0470

    Cross-site Scripting (XSS) - Stored in modoboa/modoboa

    Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.

    modoboa modoboa/modoboa modoboa PyPI
  • High 7.1
    CVE-2023-0519

    Cross-site Scripting (XSS) - Stored in modoboa/modoboa

    Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.

    modoboa modoboa/modoboa modoboa PyPI