Delete mailbox via API - Access Denied

Contribution guidelines

• I've read the contribution guidelines and wholeheartedly agree

Checklist prior issue creation

• I understand that failure to follow below instructions may cause this issue to be closed.
• I understand that vague, incomplete or inaccurate information may cause this issue to be closed.
• I understand that this form is intended solely for reporting software bugs and not for support-related inquiries.
• I understand that all responses are voluntary and community-driven, and do not constitute commercial support.
• I confirm that I have reviewed previous issues to ensure this matter has not already been addressed.
• I confirm that my environment meets all prerequisite requirements as specified in the official documentation.

Description

When using the API, even from the Open API it gives us access_denied error when trying to delete a mailbox. The api key (read/write) was created with admin account and has no restrictions.

Steps to reproduce:

access mailcow.domain/api Click on authorize Put your API Key, Go to api/v1/delete/mailbox Change the email account to the one you desire to remove Click execute.

Logs:

not needed

Which branch are you using?

master (stable)

Which architecture are you using?

x86_64

Operating System:

Ubuntu 24.04

Server/VM specifications:

8gb, 4 vcpu

Is Apparmor, SELinux or similar active?

No

Virtualization technology:

KVM

Docker version:

latest

docker-compose version or docker compose version:

latest

mailcow version:

not needed

Reverse proxy:

none

Logs of git diff:

Logs of iptables -L -vn:

not needed

Logs of ip6tables -L -vn:

not needed

Logs of iptables -L -vn -t nat:

not needed

Logs of ip6tables -L -vn -t nat:

not needed

DNS check:

not needed