CVE-2026-114715
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the acco
Roundcube WebmailApplications & CMS
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.
Text from CVE List
Affected versions 2
- Webmailaffected: 1.6.0 before 1.6.20CVE List
- Webmailaffected: 1.7.0 before 1.7.5CVE List
References 6
- github.com/roundcube/roundcubemail/commit/e6a77272a5837e7104238a2f270ac412ff0a8ff3Fixvia CVE List
- github.com/roundcube/roundcubemail/releases/tag/1.7.5Fixvia CVE List
- github.com/roundcube/roundcubemail/releases/tag/1.6.20Fixvia CVE List
- github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9Fixvia CVE List
- bugs.debian.org/1151279Advisoryvia CVE List
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Advisoryvia CVE List