CVE-2026-75010
MediumCVSS 6.4Summary
Roundcube Webmail before 1.6.18 and 1.7.3 has a vulnerability in the modoboa driver of the password plugin that could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This affects only instances using the password plugin with the modoboa driver.
Risk Assessment
Risk of API token theft leading to unauthorized access to mail services and account compromise.
Recommendation
Upgrade Roundcube Webmail to 1.6.18 or 1.7.3 and review password plugin configuration.
Original NVD description (English source)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.