Verification of the upstream fix commits for CVE-2026-56780 and CVE-2026-90910 identified sibling custom actions on Modoboa REST API viewsets that either query global model managers instead of tenant-scoped querysets or rely on default DjangoModelPermissions mappings for custom POST actions.
When Django REST Framework viewsets define custom @action(methods=['post']) endpoints alongside DjangoModelPermissions, POST actions default to checking the model's add_* permission unless overridden in get_permissions(), and actions that query Model.objects directly bypass tenant and role filtering in get_queryset().
In accordance with Modoboa's security policy, technical specifics and a remediation patch are withheld while coordinated disclosure with security@modoboa.org is in progress.
Apply the upstream Modoboa security update once released.