Roundcube Webmail: Incorrect authorization in Modoboa password driver
Summary
The Modoboa driver of the password plugin in Roundcube Webmail selected the first account returned by the Modoboa API instead of the logged-in user. An authenticated user could therefore change the password of a different mail account. The issue only affects installations that use the password plugin with the Modoboa driver.
Affected
- Roundcube Webmail 1.6.0 to before 1.6.20
- Roundcube Webmail 1.7.0 to before 1.7.5
- Installations without the password plugin and Modoboa driver are not affected by this CVE.
Fixed in
- Roundcube Webmail 1.6.20 (1.6 branch)
- Roundcube Webmail 1.7.5 (1.7 branch)
Workaround
- Unknown.
- Disable the password plugin or at least the Modoboa driver until the update is installed.
Exploitation
- No active exploitation reported.
- No public proof of concept found.
- Exploitation requires a valid Roundcube login.
Our recommendation
- Update Roundcube Webmail to 1.6.20 or 1.7.5, or to a distribution package that contains the fix.
- Check whether the password plugin with the Modoboa driver is enabled; if not, the CVE does not apply.
- If patching is delayed, disable the password plugin or the Modoboa driver.
- Review password change logs for changes to accounts that were not made by their owners.
- Verify the CVSS score in NVD before using it for prioritisation, as sources differ (8.1 versus 6.8 and 6.3).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD/CVE record source: Roundcube commit 3d9d05b github.com
- Roundcube commit e6a7727 github.com
- Roundcube 1.6.20 release github.com
- Roundcube 1.7.5 release github.com
- Roundcube security updates 1.6.20 and 1.7.5 roundcube.net
- Debian security tracker for roundcube security-tracker.debian.org
- OSV entry DEBIAN-CVE-2026-114715 osv.dev
- VulDB CVE-2026-114715 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:08.
Original description (NVD)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.
NVD references (6)
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
- https://github.com/roundcube/roundcubemail/commit/e6a77272a5837e7104238a2f270ac412ff0a8ff3
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.