{"id":"CVE-2026-114715","kind":"vulnerability","aliases":["CVE-2026-114715"],"related":[],"title":"Roundcube: password plugin's Modoboa driver can change another account's password","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.","summary":"The Modoboa driver of Roundcube's password plugin picked the first account in an API search result instead of the logged-in user, so a password change could land on a different mailbox account. An attacker with a Roundcube login could reset another user's mail password.","severity":"medium","cvss":6.8,"epss":0.00341,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail","modoboa","package","roundcube","self-hosted"],"not_affected_if":["managed-hosting","other-password-driver","password-plugin-disabled"],"how_to_check":"- Check the Roundcube version with `grep -r \"RCMAIL_VERSION\" program/include/iniset.php`\n- Check whether the password plugin is enabled and set to the Modoboa driver in `plugins/password/config.inc.php` (look for `password_driver` set to `modoboa`)","fix":"- Upgrade Roundcube to `1.6.20` on the 1.6 branch or `1.7.5` on the 1.7 branch\n- If upgrading is not possible, disable the password plugin or switch away from the Modoboa driver until patched","status":"open","published_at":"2026-10-22T02:16:58+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:42:53+00:00","updated_at":"2026-10-25T03:42:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube to `1.6.20` on the 1.6 branch or `1.7.5` on the 1.7 branch\n- If upgrading is not possible, disable the password plugin or switch away from the Modoboa driver until patched","reach":"internet","title":"Roundcube: password plugin's Modoboa driver can change another account's password","impact":"medium","summary":"The Modoboa driver of Roundcube's password plugin picked the first account in an API search result instead of the logged-in user, so a password change could land on a different mailbox account. An attacker with a Roundcube login could reset another user's mail password.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","modoboa","mail"],"confidence":0.7,"needs_auth":"yes","worst_case":"A logged-in user changes another account's mail password","analyst_note":"","how_to_check":"- Check the Roundcube version with `grep -r \"RCMAIL_VERSION\" program/include/iniset.php`\n- Check whether the password plugin is enabled and set to the Modoboa driver in `plugins/password/config.inc.php` (look for `password_driver` set to `modoboa`)","needs_analyst":false,"not_affected_if":["password-plugin-disabled","other-password-driver","managed-hosting"],"who_is_affected":"Only deployments that run Roundcube with the password plugin using the Modoboa driver to manage mail accounts are exposed. Installs using other password drivers or without the password plugin are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000625,"input_tokens":3437,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114715':15A,18A '-2026':14A,17A '1.6.20':77C '1.7':79C '1.7.5':82C 'account':10A,37B,60B,106C,130C,148C,152C 'affect':84C 'anoth':9A,69B,147C 'api':40B,113C 'appli':126C 'attack':62B 'authent':118C 'author':88C 'bug':138C 'chang':8A,53B,123C,144C 'commit':136C 'could':54B,67B,124C,143C 'cve':13A,16A 'differ':58B,129C 'driver':6A,28B,93C,99C,142C 'entri':103C 'fail':157C 'first':36B,102C 'fix':132C,137C 'host':25B 'incorrect':87C 'instead':43B,114C 'land':55B 'log':47B 'logged-in':46B 'login':66B 'mail':19B,72B 'mailbox':59B 'match':116C,155C 'modoboa':5A,20B,27B,92C,112C,141C 'none':159C 'packag':21B 'password':2A,12A,32B,52B,73B,96C,122C,140C,145C 'pick':34B 'plugin':3A,33B,97C 'reset':68B 'result':42B,108C 'return':109C 'roundcub':1A,22B,30B,65B,74C 'search':41B,107C 'select':150C 'self':24B 'self-host':23B 'took':100C 'upstream':131C 'user':49B,70B,119C 'usernam':154C 'vulner':89C 'webmail':75C 'whose':153C 'x':80C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run Roundcube with the password plugin using the Modoboa driver to manage mail accounts are exposed. Installs using other password drivers or without the password plugin are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114715","severity":null,"published_at":"2026-10-22T02:16:58+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114715","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114715","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}