CVE-2026-114715: Medium severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use the Modoboa driver in Roundcube's password plugin and run a Roundcube Webmail release before 1.6.20, or a 1.7.x release before 1.7.5.
What level of access does an attacker need?
The vulnerability requires low-privileged authenticated access. No user interaction is required, but exploitation has high attack complexity.
How can I determine whether my deployment is exposed?
Check the installed Roundcube version and the password plugin configuration. A deployment is exposed if it uses the Modoboa driver and is below the fixed release for its branch.