In Modoboa before version 2.8.0, an insecure direct object reference allows a logged‑in user to create auto‑reply messages for any mailbox by providing another user’s mbox value. The attacker can POST to /api/v2/armessages/ with payloads that inject custom subject and content into the victim’s settings, or can trigger MultipleObjectsReturned errors that break auto‑reply management.

All Modoboa 2.7.x installations and earlier are affected. Any deployment running a version later than 2.8.0 is not vulnerable.

The vulnerability has a CVSS score of 5.3, indicating a moderate impact. EPSS is not available, and the flaw is not listed in CISA’s KEV catalog. Because the exploit requires an authenticated session, the attacker first needs legitimate credentials, but once authenticated can create or disrupt auto‑reply messages for any mailbox without further authorization. The risk is higher in environments where many users share the same account or where privileged users have broad access rights.