Live › vulnerability › CVE-2026-114715
Go to dashboardThe Modoboa driver of Roundcube's password plugin picked the first account in an API search result instead of the logged-in user, so a password change could land on a different mailbox account. An attacker with a Roundcube login could reset another user's mail password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments that run Roundcube with the password plugin using the Modoboa driver to manage mail accounts are exposed. Installs using other password drivers or without the password plugin are not affected by this flaw.
No product ranges from the sources yet.
grep -r "RCMAIL_VERSION" program/include/iniset.phpplugins/password/config.inc.php (look for password_driver set to modoboa)1.6.20 on the 1.6 branch or 1.7.5 on the 1.7 branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.
This page as .md · .json · in your agent: get_signal("CVE-2026-114715")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.