Modoboa Instances Need Domain-Scoped Access Reviews, Not Just Exposure Counts

·1 views

Modoboa is a mail hosting and administration platform whose users, domains, aliases, and API tokens reveal how an organization's email is structured. A ZoomEye count-only query returned 975 application matches and 980 title matches for Modoboa, though these numbers alone do not confirm exposed servers. The official API requires token authentication, and a domain administrator's token should not be able to manage other domains. The article recommends testing whether such tokens can cross domain boundaries, and whether the API and web interface enforce the same permissions. It also flags self-service settings like forwarding and password recovery as possible account-takeover paths.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Apple updates App Store screenshot rules, adds required iPhone Dynamic Island slot

Developers uploading to App Store Connect may see dimension errors because Apple's screenshot requirements have changed as of November 1, 2026. Apps now need at least one iPhone screenshot sized for the Dynamic Island display, and iPad apps must supply iPad 13-inch images, with App Store Connect scaling the rest. Apple has announced that from April 2027, apps built with the iOS 27.1 SDK or later will need iPhone Duo screenshots, and those submissions will earn an "optimized for iPhone Duo" badge. Screenshots must be PNG or JPEG without an alpha channel, a common problem with rounded-corner Simulator captures. The article's author, who builds a screenshot tool, also shares a full size reference table covering additional devices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitLab Critical Flaw CVE-2026-97229 Prompts Security Review of CI/CD Pipelines

GitLab has disclosed CVE-2026-97229, a maximum-severity vulnerability rated CVSS 10.0 that could let an unauthenticated attacker run arbitrary code on a vulnerable server via a crafted regular expression in CI/CD configuration. The flaw originates in Onigmo, the regular-expression engine used by Ruby, rather than solely in GitLab's own code. Alpine Linux reported that attackers tried to exploit its GitLab instance on October 20 and 21, about a week after disclosure, and although no successful code execution was found, it rebuilt the instance as a precaution. Organizations running custom Ruby builds or container images must update Ruby separately, as upgrading GitLab alone may not fix the issue. Experts stress that self-managed GitLab instances often hold source code, secrets, and cloud credentials, so a compromise could escalate into a software supply-chain attack.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Parley: Open-Source Messaging Template for Brandable Private Chat Apps

Organizations that need their own messenger, without relying on WhatsApp or a third-party platform, now have a ready-made option. Parley is a finished messaging template built on Codename One, an open-source framework for native iOS, Android, desktop and web apps from one codebase. It covers one-to-one and group chats, broadcast channels, encrypted media, voice and video calls, and an admin console, and is released under MIT-0 so adopters can rebrand and keep their changes private. Its encryption follows the Signal design, using X3DH key agreement and the Double Ratchet, so the server only relays ciphertext it cannot read. Calls are peer-to-peer over WebRTC, and the brand color and other visual elements are configurable from a single stylesheet.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AWS NAT gateway costs break down into hourly, data processing and transfer charges

An AWS NAT gateway lets servers without public IP addresses reach the internet, and its bill combines an hourly charge with a per-gigabyte processing fee. Pricing differs by Region, with us-east-1 and Frankfurt rates given as examples in the article. AWS bills every provisioned hour, and running a gateway in each Availability Zone for production multiplies that baseline cost. Internet-bound traffic also incurs standard data transfer charges, and cross-zone traffic adds a smaller fee, so placing data-heavy servers in their gateway's zone helps. The article also recommends a free S3 gateway endpoint to bypass gateway charges for same-Region S3 traffic.

0 comments Read more at DEV Community