CVE-2026-75010

EUVD-2026-60174
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
6.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
roundcubewebmail
1.6.0 ≤
𝑥
< 1.6.18
CNA
roundcubewebmail
1.7.0 ≤
𝑥
< 1.7.3
CNA
Debian logo
Debian Releases
Debian Product
Codename
roundcube
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
1.6.18+dfsg-1
fixed
sid
1.6.18+dfsg-1
fixed
trixie
vulnerable
trixie (security)
vulnerable
Common Weakness Enumeration
References
https://github.com/roundcube/roundcubemail/commit/65b8ea9d8304b10f1d3bda5bcc82f9c682cf804c
https://github.com/roundcube/roundcubemail/commit/b0e26d617e7bbe3051135285993bc55f718fea2f
https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3