We use cookies to build anonymous visit statistics. They are only set if you accept. Know more

Accept Decline

Releases Modoboa 2.11.0 and 2.11.1

Antoine NguyenOct. 9, 2026 — Antoine Nguyen

Security fixes in 2.11.1

  • Domain administrators could take over SuperAdmin and Reseller accounts that own a mailbox in their domain. The migrate command removes the access already granted.
  • Any authenticated user, including simple users, could create relay domains through the CSV import. The import now checks permissions and limits.
  • A reseller could give a domain alias the name of a domain owned by another tenant, and so disrupt or redirect part of that tenant's inbound mail. Domain and domain alias names now share the same namespace.
  • Frontend dependencies are forced to patched versions of undici and adm-zip (#4263).

2.11.0 had already tightened other access checks:

  • the CSV import of domain administrators checks access to the domain (#4214)
  • the CSV import of domain aliases checks access to the target (#4217)
  • Amavis self-service authentication honors the self_service parameter (#4215)
  • the Amavis recipient filter for simple users is escaped and anchored (#4216)

Before you upgrade

  • Postfix (required if you use sending limits): without this change, limits will no longer be enforced. The policy daemon now decrements counters only once a message has been accepted, so Postfix must also query it at the end of the DATA stage.
  • Recommended: set the address of the syslog handlers in settings.py, and serve OAuth2 introspection from a dedicated uWSGI instance to avoid webmail lock-ups.
  • Domain alias check (2.11.1): a new system check reports inconsistencies left by previous versions. Review domain aliases that use a domain name by hand (modoboa.admin.W001). The other problems are fixed by the repair command:
python manage.py check --database default
python manage.py modo repair --dry-run
python manage.py modo repair

The upgrade guide has every step.

Webmail

  • Conversation view: messages can be grouped into threads (IMAP THREAD extension), with a redesigned message display. It is turned on with a new user preference; the flat listing stays the default (#4212)
  • Listing: refined toolbar and loading state (#4223)
  • Performance: fewer IMAP round trips and redundant requests (#4224), and a faster subscriptions dialog on large folder hierarchies (#4270)
  • Messages: no more blank message body in Chromium (#4244), better handling of message formats (#4265), and several fixes in the message composer (#4254, #4266)
  • Other fixes: messages without a Date header are displayed (#4219), unfolding a mailbox no longer risks a timeout (#4220), the selection is cleared after deleting messages or moving them to junk (#4221), and subjects made of adjacent encoded words are decoded correctly (#4222)

Calendars

  • Shared calendars: calendars shared with you are now displayed (#4242)
  • Rights endpoint: a new endpoint for the radicale-modoboa-rights plugin makes shared calendars work even when Radicale runs on another server (#4238). Calendar names are now unique per owner: existing duplicates are renamed ("Name (2)") and keep their data.
  • Recurring events: every occurrence is displayed, and you choose whether a change applies to one occurrence or to the whole series. Moving an event to another calendar now works (#4234)
  • Display: working hours are highlighted and weekends greyed out (#4235)
  • Performance: no more Radicale authentication delay, and calendars load in parallel (#4233)
  • Access rule fixes: rules are nested under their calendar (#4225), the rights file is regenerated when rules are removed (#4226), and rule validation is fixed (#4241)

Administration and deployment

  • Modoboa Pro is now highlighted in the admin interface (#4253)
  • Mailbox renames: a mailbox is never left blocked by a pending rename operation (#4276)
  • Sieve: single-condition filters are handled correctly (#4256)
  • deploy command: a new --redisurl option for Redis on a unix socket (#4273), and database options such as SSL given in --dburl are kept in settings.py (#4271)
  • Other fixes: policy daemon counters and logging (#4211), the interface loads all domains and not only the first page (#4227), and a DKIM key can be regenerated whether it exists or is missing (#4243)

Dependencies, localization and development

  • Dependencies: the mysqlclient requirement is raised to <2.3.1 (#4210), caldav goes from 3.3.0 to 3.3.1 (#4213), frontend packages are updated (#4257, #4259, #4267, #4268, #4269, #4272), and the documentation tooling is updated (#4231, #4232)
  • Translations: French and Japanese are updated
  • Development: Amavis is optional in the development environment (#4228), the Docker setup gets Radicale client credentials (#4247), CI is faster and the test suite runs in parallel (#4255, #4258, #4260, #4261, #4262, #4264)

Thanks

Welcome to our new contributors Jah-yee, ScionOfDesign and raeesahmed77, and thanks to kryskool for the documentation work!

Upgrade

After the version-specific steps above:

pip install -U modoboa
cd <modoboa_instance_dir>
python manage.py migrate
python manage.py collectstatic
python manage.py check --deploy
python manage.py load_initial_data
sudo systemctl restart uwsgi supervisor

Full changelog: 2.10.1...2.11.1

Tags: modoboa release security
Previous post