CVE-2026-75010

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3

Description The modoboa driver of the password plugin can leak a Modoboa API authentication token to a host controlled by the user through crafted session data. This issue specifically impacts instances configured to use the password plugin with the modoboa driver.

Recommendations Update to version 1.6.18 or later. Update to version 1.7.3 or later. Restrict the use of the modoboa driver within the password plugin as a temporary mitigation.