Loading vulnerability…
Modoboa API Token Disclosure in Roundcube Webmail Password Plugin
Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 contains an information disclosure vulnerability in the password plugin's modoboa driver. Crafted session data can cause the driver to disclose a Modoboa API authentication token to a user-controlled host. Only instances using the password plugin with the modoboa driver are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can obtain a Modoboa API authentication token. The exposed credential could enable unauthorized API access or abuse within the permissions granted to that token. The vulnerability is rated medium severity with a reported CVSS score of 6.4.
If you can’t patch tonight, do this now.
If patching is not immediately possible, disable the password plugin or stop using its modoboa driver. Limit untrusted control over session data and restrict outbound connectivity from Roundcube to prevent requests to untrusted hosts where feasible.
Patch, then assume compromise.
Upgrade Roundcube Webmail to 1.6.18 or later in the 1.6 branch, or 1.7.3 or later in the 1.7 branch. For Debian stable (trixie), upgrade the Roundcube packages to 1.6.18+dfsg-0+deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.