CVE-2026-114715CWE-863broken-access-control

CVE-2026-114715

Medium · published October 22, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-22T06:16Z
References (6)
https://bugs.debian.org/1151279 · [email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 · [email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 · [email protected]https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 · [email protected]https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9 · [email protected]https://github.com/roundcube/roundcubemail/commit/e6a77272a5837e7104238a2f270ac412ff0a8ff3 · [email protected]
EPSS history
Timeline
  • 23 OCT 03:55Z
    EPSS moved — → 0%
    epss
  • 22 OCT 01:13Z
    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin
    cvelistv5
  • 22 OCT 01:13Z
    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin
    cvelistv5