Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 contain an incorrect authorization flaw in the Modoboa driver of the password plugin. The driver takes the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, allowing a password change to be applied to a different account. This flaw permits an attacker who has authenticated to change the password of another user, potentially leading to account takeover.

Affected products are Roundcube Webmail 1.6.x before 1.6.20 and 1.7.x before 1.7.5. Any deployment using the Modoboa password driver is vulnerable.

The CVSS score of 6.8 indicates moderate severity. The EPSS score is < 1%, showing a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA KEV. The attack vector is inferred to be an authenticated session; an authenticated user can modify another user’s password because the driver selects the first account returned by the Modoboa API instead of matching the username, allowing unauthorized password changes.