EUVD-2026-60174
GHSA-qv9q-5762-xc65
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects mandatory Roundcube account; S:C with C:H/I:H captures that the leaked Modoboa admin API token grants full cross-system account control.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.
AnalysisAI
Token exfiltration in Roundcube Webmail's modoboa password driver allows authenticated users to redirect server-side Modoboa API requests - including the admin API credential - to attacker-controlled hosts by manipulating session IMAP host data. Versions before 1.6.18 and 1.7.x before 1.7.3 are affected, but only deployments using the password plugin with the modoboa driver are exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Roundcube webmail account, confirmed by the CVSS vector PR:L; unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N understates real-world impact: the C:L and I:L sub-scores capture only the immediate effect within Roundcube's scope, while the scope change (S:C) signals that the exfiltrated Modoboa API token operates in a different security domain where its possession could yield full administrative control over all hosted mail accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Roundcube user manipulates their session to replace the stored IMAP host value with an attacker-controlled domain, then initiates a password change through the Roundcube web interface. The modoboa driver constructs a cURL request to the attacker's HTTPS server, transmitting the full Authorization: Token header containing the server-side Modoboa API credential; the attacker's server logs the token. … |
| Remediation | Upgrade to Roundcube Webmail 1.6.18 (stable branch) or 1.7.3 (development branch) as documented in the vendor security advisory at https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3; both releases introduce a dedicated password_modoboa_api_host configuration parameter replacing session-derived host resolution and enforce sanitization via rcube_utils::parse_host(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today