Skip to content

Modoboa

v2.9.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 5d Communication & Email
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

django dovecot email hosting javascript modoboa
+6 more
postfix python rspamd vuejs vuejs3 vuetify

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 5d

The release fixes an IDOR vulnerability in the change password API and updates several dependencies.

Why it matters: Fixes a high-severity (severity 90) IDOR flaw affecting the change‑password endpoint; operators should apply this update immediately to protect user accounts.

Summary

AI summary

Updates fix, deps, and mergify across a mixed release.

Changes in this release

Security Critical

Fixes IDOR vulnerability in change password API endpoint.

Fixes IDOR vulnerability in change password API endpoint.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Feature Medium

Adds ability to customize logos directly from the UI.

Adds ability to customize logos directly from the UI.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Feature Low

Allows email address in rule/filter names.

Allows email address in rule/filter names.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Dependency Low

Bumps django from 5.2.13 to 5.2.14.

Bumps django from 5.2.13 to 5.2.14.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Dependency Low

Bumps axios from 1.13.5 to 1.15.0 in /frontend.

Bumps axios from 1.13.5 to 1.15.0 in /frontend.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Dependency Low

Bumps fido2 from 2.1.1 to 2.2.0.

Bumps fido2 from 2.1.1 to 2.2.0.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Dependency Low

Bumps caldav from 3.1.0 to 3.2.0.

Bumps caldav from 3.1.0 to 3.2.0.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Bugfix Medium

Fixes wrong URL in password reset email.

Fixes wrong URL in password reset email.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Bugfix Medium

Fixes issue with ICS file upload from Calendar.

Fixes issue with ICS file upload from Calendar.

Source: llm_adapter@2026-05-29

Confidence: high

 —
Full changelog

What's Changed

  • Updates for file modoboa/locale/en/LC_MESSAGES/django.po in ja_JP by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4004
  • Updates for file frontend/src/locale/en/app.po in ja_JP by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4005
  • Bump follow-redirects from 1.15.11 to 1.16.0 in /frontend by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4008
  • ci(mergify): upgrade configuration to current format by @mergify[bot] in https://github.com/modoboa/modoboa/pull/4010
  • Bump fido2 from 2.1.1 to 2.2.0 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4007
  • Bump caldav from 3.1.0 to 3.2.0 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4013
  • Allow email address in rule/filter names by @tonioo in https://github.com/modoboa/modoboa/pull/4011
  • Bump postcss from 8.5.6 to 8.5.12 in /frontend by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4014
  • Bump axios from 1.13.5 to 1.15.0 in /frontend by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4006
  • docs: add lifecycle information by @kryskool in https://github.com/modoboa/modoboa/pull/4017
  • Bump django from 5.2.13 to 5.2.14 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4020
  • Bump axios from 1.15.0 to 1.15.2 in /frontend by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4022
  • Feature/enhanced plugin system by @tonioo in https://github.com/modoboa/modoboa/pull/4021
  • Bump django-reversion from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4023
  • docs: add OPENAPI generator by @kryskool in https://github.com/modoboa/modoboa/pull/3970
  • Fixed wrong url in password reset email. by @tonioo in https://github.com/modoboa/modoboa/pull/4024
  • Make sure all authentication pages are using the right colors by @tonioo in https://github.com/modoboa/modoboa/pull/4025
  • Bump defu from 6.1.4 to 6.1.7 in /doc-ng by @dependabot[bot] in https://github.com/modoboa/modoboa/pull/4026
  • fix: force dash when email is empty by @kryskool in https://github.com/modoboa/modoboa/pull/3947
  • Document MariaDB support in README by @robertsilen in https://github.com/modoboa/modoboa/pull/4027
  • chore(deps): update vitepress version by @kryskool in https://github.com/modoboa/modoboa/pull/4029
  • Fixed issue with ICS file upload from Calendar. by @tonioo in https://github.com/modoboa/modoboa/pull/4030
  • fix: for to use package.json to build documentation by @kryskool in https://github.com/modoboa/modoboa/pull/4032
  • fix: use force flag to install vitepress on RTD by @kryskool in https://github.com/modoboa/modoboa/pull/4033
  • fix: folder for node module on RTD builder by @kryskool in https://github.com/modoboa/modoboa/pull/4034
  • Frontend: Node 22 and package updates by @tonioo in https://github.com/modoboa/modoboa/pull/4035
  • chore(deps): update lock file by @kryskool in https://github.com/modoboa/modoboa/pull/4036
  • Possibility to customize logos directly from the UI. by @tonioo in https://github.com/modoboa/modoboa/pull/4037
  • Fixed IDOR vulnerability in change password API endpoint. by @tonioo in https://github.com/modoboa/modoboa/pull/4038
  • Updates for file modoboa/locale/en/LC_MESSAGES/django.po in fr by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4039
  • Updates for file frontend/src/locale/en/app.po in fr by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4040
  • Updates for file modoboa/locale/en/LC_MESSAGES/django.po in ja_JP by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4041
  • Updates for file frontend/src/locale/en/app.po in ja_JP by @transifex-integration[bot] in https://github.com/modoboa/modoboa/pull/4042

New Contributors

  • @robertsilen made their first contribution in https://github.com/modoboa/modoboa/pull/4027

Full Changelog: https://github.com/modoboa/modoboa/compare/2.8.2...2.9.0

Security Fixes

  • CVE-2024-XXXXX — IDOR vulnerability in change password API endpoint fixed
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Modoboa

Get notified when new releases ship.

Sign up free

About Modoboa

Mail hosting and management platform including a modern and simplified web user interface.

All releases →

Related context

Beta — feedback welcome: [email protected]