CVE-2026-114715
Description
A flaw was found in Roundcube Webmail. This vulnerability allows an authenticated remote user to take over another account through unauthorized password modification. When a password change is requested, the Modoboa driver in the password plugin selects the first account returned by the API search rather than verifying it matches the authenticated user. Consequently, an attacker can overwrite the credentials of a different user account.
Statement
This vulnerability is rated as Moderate impact for Red Hat because exploitation requires valid authentication credentials and depends on an optional, non-standard deployment configuration. The issue only manifests when the password management plugin is explicitly enabled and configured to interface with a Modoboa backend service, rather than default authentication mechanisms. Furthermore, Roundcube Webmail is not shipped as part of core Red Hat Enterprise Linux, limiting exposure to community-supported environments such as EPEL.
Mitigation
Upgrade to Roundcube Webmail 1.6.20 (1.6 LTS) or 1.7.5. Interim workaround: disable the Modoboa driver in the password plugin (or disable password changes) until upgraded.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
An attacker could gain unauthorized access to system resources.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
