Roundcube Webmail CVE-2026-75010

Exploitation requires a valid authenticated Roundcube webmail account, confirmed by the CVSS vector PR:L; unauthenticated access is not sufficient. The target Roundcube instance must have the password plugin enabled AND specifically configured to use the modoboa driver - instances using any other password driver (sql, ldap, virtualmin, cpanel, or others) are entirely unaffected. The attacker must be able to control or influence the IMAP host value persisted in their session, which vulnerable versions read directly from $_SESSION['imap_host'] without validation, as confirmed by the commit diff. The Roundcube server must have network egress to attacker-controlled infrastructure on HTTPS (TCP 443), which is typical in most deployments but may be restricted by egress firewall rules. The leaked credential is the server-side Modoboa API token stored in the Roundcube configuration file - not the end-user's own password. Exploitation is bounded to users who can trigger the modoboa password-change flow.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N understates real-world impact: the C:L and I:L sub-scores capture only the immediate effect within Roundcube's scope, while the scope change (S:C) signals that the exfiltrated Modoboa API token operates in a different security domain where its possession could yield full administrative control over all hosted mail accounts. EPSS data is absent from the provided intelligence, and the absence of a CISA KEV listing suggests exploitation has not been observed at scale; however, even a mid-sized municipal IT team in kalisz operating a Modoboa-backed Roundcube deployment should treat this as urgent, because the admin API token is a single credential that pivots directly to Modoboa account takeover without additional exploitation steps. The narrow deployment condition - modoboa driver must be specifically enabled - materially limits the exposed population but does not diminish impact for sites that do meet it. No public proof-of-concept is identified, which lowers near-term automated exploitation risk, but the attack chain is straightforward enough that absence of public POC is not a strong mitigating signal for affected operators.

An authenticated Roundcube user manipulates their session to replace the stored IMAP host value with an attacker-controlled domain, then initiates a password change through the Roundcube web interface. The modoboa driver constructs a cURL request to the attacker's HTTPS server, transmitting the full Authorization: Token header containing the server-side Modoboa API credential; the attacker's server logs the token. The attacker then authenticates directly to the legitimate Modoboa API using the captured token and gains administrative access to enumerate, modify, or delete all hosted mail accounts. No public proof-of-concept code is identified at time of analysis.