Roundcube Webmail EUVD-2026-107807

Requires Roundcube Webmail configured to use the password plugin's Modoboa driver, which implies a Modoboa mail-hosting backend - this is a non-default configuration, so installations using other password drivers are unaffected. The attacker must be an authenticated Roundcube user (PR:L). The limiting factor that drives AC:H is that exploitation hinges on the Modoboa API account search returning a different account as the first entry, ordering the attacker does not control; success is therefore conditional and opportunistic rather than reliable. No user interaction by a victim is needed.

This is a medium-severity (CVSS 6.8) incorrect-authorization flaw (CWE-863). The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N shows a network-reachable issue but with high attack complexity and required low-level privileges (an authenticated Roundcube user). No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation status is: no public exploit identified at time of analysis. The high attack complexity is meaningful here - success depends on the Modoboa API account-search returning a victim's account as the first entry, which the attacker does not reliably control, making exploitation opportunistic rather than deterministic. Combined with the fact that the bug only affects deployments that specifically configure the password plugin's Modoboa driver (not the default), real-world risk is lower than the 6.8 score suggests for the general Roundcube population. This should be patched on Modoboa-backed deployments but does not rise to emergency priority. Missing data to note explicitly: EPSS probability not provided, CISA KEV status not confirmed in input, and POC availability unknown.

On a Roundcube deployment using the password plugin's Modoboa driver, a legitimately authenticated user submits a password change. Because the driver takes the first entry of the Modoboa API account-search result instead of matching the authenticated username, the new password can be written to a different account, enabling takeover of that account. No public exploit was identified, and the high CVSS attack complexity reflects that success depends on the API returning a non-attacker account first.