CVE-2023-5690: Cross-Site Request Forgery (CSRF) in modoboa/modoboa
Summary
CVE-2023-5690: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2. Affects modoboa across 2 version ranges.
< 2.2.2
< 23e4c25511c66c0548da001236f47e19e3f9e4d9
Fixed in 23e4c25511c66c0548da001236f47e19e3f9e4d9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
modoboa is an open-source email hosting and management platform written in Python. It provides a web-based interface for managing email accounts, domains, and other related features. The vulnerability in modoboa prior to version 2.2.2 allows for Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability in modoboa allows an attacker to trick authenticated users into performing unintended actions on their behalf. By crafting a malicious request and tricking a user into visiting a specially crafted webpage or clicking on a malicious link, the attacker can perform actions on the user's behalf without their consent. This can lead to unauthorized access, data manipulation, or other malicious activities.
How To Fix
Latest published version: 2.11.1 as of 23 Oct 2026
pip install --upgrade "modoboa==2.11.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
23e4c25511c66c0548da001236f47e19e3f9e4d9
This is the first release that contains the fix.
pip install --upgrade "modoboa==23e4c25511c66c0548da001236f47e19e3f9e4d9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version as soon as possible.
Conclusion
The CSRF vulnerability in modoboa prior to version 2.2.2 can lead to unauthorized access and data manipulation. It is crucial to upgrade to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for modoboa →
FAQ
modoboa is an open-source email hosting and management platform written in Python. It provides a web-based interface for managing email accounts, domains, and other related features.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the case of modoboa, it allows an attacker to perform actions on behalf of an authenticated user without their consent.
The CSRF vulnerability in modoboa can lead to unauthorized access, data manipulation, or other malicious activities. An attacker could perform actions on behalf of a user, potentially compromising their account or accessing sensitive information.
To fix this vulnerability, it is recommended to upgrade modoboa to version 2.2.2 or later. The fix for this vulnerability was implemented in commit 23e4c25511c66c0548da001236f47e19e3f9e4d9.
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for modoboa.
