CVE-2026-75010 in Roundcube
Summary
by MITRE • 08/17/2026
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.18 and version 1.7.x prior to 1.7.3 represents a significant security flaw within the authentication infrastructure of specific deployment configurations. This issue is not inherent to the core Roundcube application but is isolated to instances that utilize the password plugin with its modoboa driver enabled. The root cause lies in how session data is handled during the interaction between Roundcube and the Modoboa API for password management operations. Specifically, the implementation fails to properly sanitize or restrict the storage of sensitive authentication credentials within the user's browser-side session state under certain conditions involving crafted input.
Technically, the flaw allows an attacker who can manipulate or inject specific data into the user's session context to exfiltrate a Modoboa API authentication token. This token is intended for server-to-server communication and should never be exposed to client-side environments where it could be intercepted by malicious scripts or third-party hosts. By crafting session data that triggers this leakage, an adversary can cause Roundcube to store the sensitive API token in a location accessible via HTTP requests directed at a host controlled by the attacker. This mechanism effectively bypasses standard security boundaries designed to keep administrative credentials isolated from user-facing interfaces and potential cross-site scripting vectors or malicious external domains.
The operational impact of this vulnerability is severe for organizations relying on Modoboa as their mail server backend while using Roundcube as the webmail interface. The leaked API authentication token grants unauthorized access to the Modoboa administration panel and associated APIs. An attacker possessing such a token can perform privileged actions, including but not limited to creating new user accounts, modifying existing account settings, accessing email metadata, or potentially escalating privileges within the mail server ecosystem. This compromises the confidentiality of organizational communications and integrity of administrative controls, as the stolen credential acts as a valid key for interacting with the backend system without requiring further authentication steps that would normally be enforced by Roundcube's web interface.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, specifically involving sensitive information leakage through improper session management and data handling. It also relates to CWE-359: Exposure of Private Personal Information if the token allows access to personal email content, though its primary risk is administrative compromise. In terms of attack vectors, this falls under ATT&CK technique T1078: Valid Accounts, as it involves the theft and misuse of valid credentials for unauthorized access. The exploitation path suggests a potential link to cross-site request forgery or malicious script injection if combined with other vulnerabilities that allow session data manipulation by external parties.
Mitigation strategies must focus on immediate version upgrades and configuration reviews. Administrators running Roundcube Webmail should upgrade to version 1.6.18 or later, or version 1.7.3 and above, where the handling of Modoboa driver credentials has been corrected to prevent leakage into user-controlled session data. For environments that cannot immediately patch due to operational constraints, it is critical to audit whether the password plugin with the modoboa driver is actively used; if not required for business operations, disabling this specific configuration eliminates the attack surface entirely. Additionally, implementing strict Content Security Policy headers can help mitigate potential exploitation vectors by restricting where session data might be transmitted or accessed via external scripts. Regular monitoring of API access logs on the Modoboa server should also be enforced to detect any anomalous usage patterns indicative of token theft and subsequent unauthorized administrative activity.