CVE-2026-113598
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other do
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 20, 2026 · Last modified: Oct 20, 2026 · CWE-639
Not enough EPSS history yet.
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
- github.comhttps://github.com/modoboa/modoboa/blob/2.7.2/modoboa/admin/api/v2/viewsets.py
- github.comhttps://github.com/modoboa/modoboa/commit/e0a4e3b9ee8ad84dba46e4c0f04cbbe7cf78c38d
- github.comhttps://github.com/modoboa/modoboa/issues/3945
- github.comhttps://github.com/modoboa/modoboa/releases/tag/2.8.0
- www.vulncheck.comhttps://www.vulncheck.com/advisories/modoboa-before-2.8.0-idor-via-api-v2-alarms-bulk-delete
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1136434.3 MED—
———A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.8hCVE-2026-1117678.6 HIG—
———MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.7hCVE-2026-1136653.7 LOW—
———ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.7hCVE-2026-1128616.3 MED—
———Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.7hCVE-2026-925396.7 MED—
———A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.7hCVE-2026-1136554.3 MED—
———ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The non-default nesting must already exist, and the bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting. This issue is fixed in version 4.33.0.7h