Improper Authorization in Roundcube Webmail Modoboa Password Plugin

CVE-2026-114715

What is CVE-2026-114715?

An improper authorization issue in the Modoboa driver of the password plugin for Roundcube Webmail allows an authenticated user to change the password of other accounts. This occurs because the driver incorrectly processes the first entry of the account search results from the Modoboa API without confirming the match with the authenticated user's credentials. As a result, password modifications intended for one account could inadvertently affect another. This vulnerability has been addressed in versions 1.6.20 and 1.7.5, ensuring that password changes are applied only to the account corresponding to the authenticated user.

References