A flaw in the Roundcube Webmail password plugin allows an attacker to change an account password without providing the current password. The weakness, identified as CWE-843, arises from a type confusion in the password comparison logic, permitting an unauthorized alteration of credentials and potential account takeover.

All installations of Roundcube Webmail running a version earlier than 1.5.14 or 1.6.14 are affected. These versions lack the mitigation present in the 1.5.14, 1.6.14, and later releases such as 1.7‑rc5.

The CVSS base score of 4.2 indicates moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Inferred from the description, the attack vector involves submitting a password change request via the web interface, likely after an attacker has authenticated or obtained session credentials. Successfully exploiting the flaw would enable password reset without the old password, thereby compromising the account.