Описание
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.
A flaw was found in Roundcube Webmail. This vulnerability allows an authenticated remote user to take over another account through unauthorized password modification. When a password change is requested, the Modoboa driver in the password plugin selects the first account returned by the API search rather than verifying it matches the authenticated user. Consequently, an attacker can overwrite the credentials of a different user account.
Отчет
This vulnerability is rated as Moderate impact for Red Hat because exploitation requires valid authentication credentials and depends on an optional, non-standard deployment configuration. The issue only manifests when the password management plugin is explicitly enabled and configured to interface with a Modoboa backend service, rather than default authentication mechanisms. Furthermore, Roundcube Webmail is not shipped as part of core Red Hat Enterprise Linux, limiting exposure to community-supported environments such as EPEL.
Меры по смягчению последствий
Upgrade to Roundcube Webmail 1.6.20 (1.6 LTS) or 1.7.5. Interim workaround: disable the Modoboa driver in the password plugin (or disable password changes) until upgraded.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.
ALT-PU-2026-19204: package `roundcube` update to version 1.7.5-alt1
EPSS
6.8 Medium
CVSS3