UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114715

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug…

Severity
High 8.1
Published
22 Oct 2026
Last changed
30 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
NVD

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cpe:a:roundcube:webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-114715
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114715