Modoboa's 975 application and 980 title matches need domain-administrator scoping
Modoboa's 975 application and 980 title matches need domain-administrator scoping Modoboa is a mail hosting and administration platform. Its users, domains, aliases, mailboxes, and API tokens can reveal the shape of an organization's email estate and the identities that control it. A product match is only the beginning. The relevant question is whether a domain administrator, reseller, or super…
Modoboa, a mail hosting and administration platform, has 975 instances matching the query app=Modoboa and 980 instances matching the query title=Modoboa, according to a ZoomEye SDK count-only query. This provides a reliable signal for further investigation, although ownership verification is still required. The official API documentation indicates that every instance provides an API, and token authentication is necessary to create or enable API access.
Administrators can log in and adjust settings to enable API access, with permissions varying based on the user's role. Domain administrators, super administrators, and API tokens need to be identified and reviewed, as they may have broader management capabilities than intended. Testing should be conducted to ensure that the API and web interface enforce the same object permissions, and that no unauthorized actions can be performed.
Self-service settings, such as mailbox forwarding or password reset, should be carefully examined to prevent account takeover. Resellers may have limitations on the number of objects they can create, but these do not replace the need for tenant isolation. The review process should focus on tenant-boundary testing, rather than simply counting login pages.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
