Is CVE-2026-113599 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-113599?

CVE-2026-113599 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-113599

Description

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.