Skip to main content

Email Spoofing by Power Users

  • Oct 20, 2026 8:44 AM UTC
  • 7 replies
  • 117 views
Novice I

We have a large number of power users and have discovered what we believe to be a significant security issue.

Currently, any power user can send an email from the platform that appears to come from any email address within our domain. They can also add any recipient they choose in the CC field.

For those of you who also have a large number of power users, how have you addressed this risk?

As a precaution, we have disabled the ability to send emails from the platform. Unfortunately, this also means that automated email notifications are no longer being delivered.

We would greatly appreciate hearing how others are handling this issue and whether you have implemented any safeguards or alternative solutions.

Thank you in advance for your insights!

    7 replies

    lrnlab
    Hero III
    Forum|alt.badge.img+10
    • lrnlab
    • Hero III
    • Oct 23, 2026 7:36 PM UTC

    hi ​@Kjersti S are you talking about the “send email” email from the enrolment tab on a course? if yes, the only way to restrict this would be to remove access to edit enrolments (and maybe view) that on that tab.

      Novice I
      • Kjersti S
      • Author
      • Novice I
      • Oct 26, 2026 8:49 AM UTC

      hi ​@Kjersti S are you talking about the “send email” email from the enrolment tab on a course? if yes, the only way to restrict this would be to remove access to edit enrolments (and maybe view) that on that tab.

      ah, well that is very unpractical since the power users are the ones that administer the courses. Thanx for answering! 

      dklinger
      Hero III
      Forum|alt.badge.img+13
      • dklinger
      • Hero III
      • Oct 26, 2026 1:11 PM UTC

      Hi ​@Kjersti S - so our cybersecurity team is continuing to monitor spoofing from all platforms and I would imagine that is how you all figured out that this is happening.

      I think the greatest challenge is understanding when it would be a “legit spoofed email” vs not….as it is invariably a form of spoofing. I would want to think by a level of governance that you may be able to drive it to come from a single email address that is considered to be safe within your environment.  Then if that one is ever hijacked, it could be managed better. It may be a great idea to be able to set a single setting for all emails to come from x email address (including manual course enrollment emails).

      Look - I know what I am saying is not the greatest answer. But unless you move away from using your own domain, I think the risk remains.

        Novice I
        • Kjersti S
        • Author
        • Novice I
        • Oct 26, 2026 1:21 PM UTC

        Hi ​@Kjersti S - so our cybersecurity team is continuing to monitor spoofing from all platforms and I would imagine that is how you all figured out that this is happening.

        I think the greatest challenge is understanding when it would be a “legit spoofed email” vs not….as it is invariably a form of spoofing. I would want to think by a level of governance that you may be able to drive it to come from a single email address that is considered to be safe within your environment.  Then if that one is ever hijacked, it could be managed better. It may be a great idea to be able to set a single setting for all emails to come from x email address (including manual course enrollment emails).

        Look - I know what I am saying is not the greatest answer. But unless you move away from using your own domain, I think the risk remains.

        Thank you! We discovered this was happening when someone was just playing around and trying to see if it was possible to change the sender to anyone. It would defently be fabolous if we had the option to set one fixed x email adress 😊!

        Novice III

        Hi ​@Kjersti S,

         

        If you’re looking to hide that functionality, you could look at deploying this CSS to hide the “Send Email” option from the Enrollment Menu entirely.

        /* START - Hide Send Email in enrollment menu */
        li.mdl-menu__item:has(> .action-send-email-massive),
        .action-send-email-massive {
          display: none !important;
        }
        /* END - Hide Send Email in enrollment menu */

        Hope this helps!

        Noah

          Novice I
          • Kjersti S
          • Author
          • Novice I
          • Oct 27, 2026 8:40 AM UTC

          Hi ​@Kjersti S,

           

          If you’re looking to hide that functionality, you could look at deploying this CSS to hide the “Send Email” option from the Enrollment Menu entirely.

          /* START - Hide Send Email in enrollment menu */
          li.mdl-menu__item:has(> .action-send-email-massive),
          .action-send-email-massive {
            display: none !important;
          }
          /* END - Hide Send Email in enrollment menu */

          Hope this helps!

          Noah

          Thanx! This will probably be helpful :)

          Docebian

          Hello! Ciaran here from Docebo Support.

          This behaviour needs review by the appropriate team, so I can’t confirm the security implications or recommend a workaround in this thread. Can you open a Support ticket and share the reproduction steps and any screenshots privately so the report can be reviewed through the appropriate channel.

           

          Many thanks

          Terms & ConditionsAccessibility statement