CVE-2026-114715

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114715", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-22T01:13:35.058Z", "datePublished": "2026-10-22T01:13:35.419Z", "dateUpdated": "2026-11-02T15:01:11.219Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit \u201cFix bug where Password Modoboa driver could change password for another account\u201d, which selects the account whose username matches and fails if none does."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-22T01:13:35.419Z"}, "references": [{"tags": ["issue-tracking", "third-party-advisory"], "url": "https://bugs.debian.org/1151279"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/e6a77272a5837e7104238a2f270ac412ff0a8ff3"}, {"tags": ["vendor-advisory", "release-notes"], "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.6.0", "versionEndExcluding": "1.6.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.0", "versionEndExcluding": "1.7.5"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T15:01:00.613147Z", "id": "CVE-2026-114715", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:01:11.219Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114715", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T15:01:00.613147Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:01:07.452Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "product": "Webmail", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "1.6.20", "versionType": "semver"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.debian.org/1151279", "tags": ["issue-tracking", "third-party-advisory"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/e6a77272a5837e7104238a2f270ac412ff0a8ff3", "tags": ["patch"]}, {"url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5", "tags": ["vendor-advisory", "release-notes"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5", "tags": ["release-notes", "patch"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20", "tags": ["release-notes", "patch"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9", "tags": ["patch"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit \u201cFix bug where Password Modoboa driver could change password for another account\u201d, which selects the account whose username matches and fails if none does."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.6.20", "versionStartIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.7.5", "versionStartIncluding": "1.7.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-22T01:13:35.419Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114715", "state": "PUBLISHED", "dateUpdated": "2026-11-02T15:01:11.219Z", "dateReserved": "2026-10-22T01:13:35.058Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-22T01:13:35.419Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "D91A1C10-A81F-420B-9DE2-078A9BBA469D", "versionEndExcluding": "1.6.20", "versionStartIncluding": "1.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "D41F4166-D4C5-4D1C-94AC-3CF3C27F1319", "versionEndExcluding": "1.7.5", "versionStartIncluding": "1.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit \u201cFix bug where Password Modoboa driver could change password for another account\u201d, which selects the account whose username matches and fails if none does."}], "id": "CVE-2026-114715", "lastModified": "2026-11-02T15:17:14.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114715", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T15:01:00.613147Z", "version": "2.0.3"}}]}, "published": "2026-10-22T02:16:58.930", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://bugs.debian.org/1151279"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/roundcube/roundcubemail/commit/e6a77272a5837e7104238a2f270ac412ff0a8ff3"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "roundcubemail: roundcubemail: Unauthorized password modification via improper account matching in Modoboa driver", "id": "2558675", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558675"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-283", "details": ["Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit \u201cFix bug where Password Modoboa driver could change password for another account\u201d, which selects the account whose username matches and fails if none does.", "A flaw was found in Roundcube Webmail. This vulnerability allows an authenticated remote user to take over another account through unauthorized password modification. When a password change is requested, the Modoboa driver in the password plugin selects the first account returned by the API search rather than verifying it matches the authenticated user. Consequently, an attacker can overwrite the credentials of a different user account."], "mitigation": {"lang": "en:us", "value": "Upgrade to Roundcube Webmail 1.6.20 (1.6 LTS) or 1.7.5. Interim workaround: disable the Modoboa driver in the password plugin (or disable password changes) until upgraded."}, "name": "CVE-2026-114715", "public_date": "2026-10-22T01:13:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114715\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114715\nhttps://bugs.debian.org/1151279\nhttps://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9\nhttps://github.com/roundcube/roundcubemail/commit/e6a77272a5837e7104238a2f270ac412ff0a8ff3\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.20\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.5\nhttps://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "statement": "This vulnerability is rated as Moderate impact for Red Hat because exploitation requires valid authentication credentials and depends on an optional, non-standard deployment configuration. The issue only manifests when the password management plugin is explicitly enabled and configured to interface with a Modoboa backend service, rather than default authentication mechanisms. Furthermore, Roundcube Webmail is not shipped as part of core Red Hat Enterprise Linux, limiting exposure to community-supported environments such as EPEL.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.0,1.6.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.0,1.7.5)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Webmail", "source": "cna", "vendor": "Roundcube"}, "product": "webmail", "vendor": "roundcube"}], "created": "2026-10-22T05:30:08.011908+00:00", "updated": "2026-11-03T02:30:07.574163+00:00", "vendors": ["roundcube", "roundcube$PRODUCT$webmail"]}