---
id: "CVE-2026-114715"
kind: "vulnerability"
aliases: ["CVE-2026-114715"]
title: "Roundcube: password plugin's Modoboa driver can change another account's password"
severity: "medium"
cvss: 6.8
epss: 0.00341
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mail", "modoboa", "package", "roundcube", "self-hosted"]
not_affected_if: ["managed-hosting", "other-password-driver", "password-plugin-disabled"]
published_at: "2026-10-22T02:16:58+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:42:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114715", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114715", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Roundcube: password plugin's Modoboa driver can change another account's password

The Modoboa driver of Roundcube's password plugin picked the first account in an API search result instead of the logged-in user, so a password change could land on a different mailbox account. An attacker with a Roundcube login could reset another user's mail password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Roundcube version with `grep -r "RCMAIL_VERSION" program/include/iniset.php`
- Check whether the password plugin is enabled and set to the Modoboa driver in `plugins/password/config.inc.php` (look for `password_driver` set to `modoboa`)

## Fix

- Upgrade Roundcube to `1.6.20` on the 1.6 branch or `1.7.5` on the 1.7 branch
- If upgrading is not possible, disable the password plugin or switch away from the Modoboa driver until patched

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114715
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114715

## From the sources

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_