Modoboa's 975 application and 980 title matches need domain-administrator scoping
Modoboa is a mail hosting and administration platform. Its users, domains, aliases, mailboxes, and API tokens can reveal the shape of an organization's email estate and the identities that control it. A product match is only the beginning. The relevant question is whether a domain administrator, reseller, or super administrator can cross a tenant boundary.
On November 2, 2026, a ZoomEye SDK count-only query returned 975 matches for app="Modoboa" and 980 for title="Modoboa" using sub_type=all, page 1, and page size 1. The near-equal counts make this a cleaner product signal than several title-only results in this batch, but they still require ownership verification.
The official REST API documentation says every instance provides an API, and token authentication is required. To create or enable API access, an administrator logs in and uses the settings page. A super administrator may enable the API; the permission model also includes domain administrators and object-level access. That distinction is important because a token that belongs to a domain administrator should not manage another domain.
A review should identify:
- Super administrators and the accounts or groups that can create them.
- Domain administrators and the exact domains they manage.
- API tokens, their owners, activation state, and storage location.
- Mailbox, alias, forwarding, and password-reset paths.
- Domain limits and self-service settings that ordinary users can change.
Test with a domain administrator token against a second domain. Try to update a mailbox, add an administrator, and read a domain-level setting outside the allowed scope. Then test the web interface with the same account. The API and UI should enforce the same object permissions. If one path allows a broader action, the API becomes the easier control path.
Self-service settings also need review. A setting that allows a user to change forwarding or password-recovery behavior can become an account-takeover path even when the user cannot read another mailbox. Domain-wide aliases can redirect mail for many users. A reseller may have limits on the number of objects it can create, but those limits are not a substitute for tenant isolation.
The 975 application and 980 title matches create a useful starting set for external discovery. Do not describe them as exposed mail servers without verification. For owned instances, prioritize token inventory and a negative authorization test across domains.
Modoboa concentrates identity, mail routing, and administrative power. The right review is a tenant-boundary test, not a login-page count.
Query evidence
app="Modoboa" returned 975 matches. title="Modoboa" returned 980. Both queries used sub_type=all, page 1, and a page size of 1.
