CVE-2026-75010

4.3 Moyenne

Publiée le 17/08/2026 à 15:16 · Modifiée le 08/09/2026 à 18:33 · Analysée par le NVD · Source : cve@mitre.org

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.

Traduire en français

Produits concernés

Roundcube Webmail

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.4 Moyenne	cve@mitre.org	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`
3.1	4.3 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-669

Références

https://github.com/roundcube/roundcubemail/commit/65b8ea9d8304b10f1d3bda5bcc82f9c682cf804c Patch
https://github.com/roundcube/roundcubemail/commit/b0e26d617e7bbe3051135285993bc55f718fea2f Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 Release Notes
https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories