Modoboa versions prior to 2.8.0 expose an insecure direct object reference vulnerability. Authenticated users can invoke the POST /api/v2/alarms/bulk_delete/ endpoint to delete alarms that belong to other domains. By sequentially enumerating alarm identifiers attackers can remove DNS, MX and blocklist monitoring alarms across the entire server, depriving administrators of critical visibility and disrupting operational safeguards. This weakness aligns with CWE‑639, which describes the unauthorized manipulation of identifiers to access resources not supposed to be available.

The affected product is Modoboa (Modoboa Inc.). All releases earlier than version 2.8.0 contain the flaw. No more granular version information is supplied, so any deployment running a pre‑2.8.0 build is susceptible.

The CVSS score of 5.3 places the vulnerability in the medium severity range. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating that it is not currently known to be exploited on a wide scale. The attack vector requires valid credentials for an account that has permission to access the /api/v2/alarms/bulk_delete/ URL, typically an authenticated user with domain management rights. Once authenticated, the user can send a POST request with a list of alarm IDs to delete; because the API does not enforce domain ownership checks, the caller can specify identifiers belonging to any domain, resulting in a cross‑domain deletion of monitoring alarms. The exploitation effort is modest, but it can cause loss of visibility and potentially allow the attacker to conceal malicious activity by removing alarm notifications.