Roundcube Webmail instances that use the password plugin with the modoboa driver can leak a Modoboa API authentication token through crafted session data. The leaked token is sent to a host controlled by an attacker, enabling the attacker to authenticate to the Modoboa system with elevated privileges. This vulnerability represents an information disclosure that can compromise the confidentiality of authentication credentials and potentially lead to unauthorized actions on the affected system.

The vulnerability affects Roundcube Webmail versions prior to 1.6.18 and all 1.7.x releases before 1.7.3. Only Roundcube installations that have the password plugin enabled with the modoboa driver are impacted. Earlier versions or installations without the plugin are not affected.

The CVSS score of 6.4 indicates a medium impact, and the EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is listed in the CISA KEV catalog as not listed, suggesting no known public exploitation. The attack would require an attacker to target a Roundcube instance that uses the vulnerable plugin and craft session data to trigger the token leak, with the token then being forwarded to any host reachable by the victim server. Because the exploit hinges on web session manipulation, it could be carried out remotely against exposed webmail servers.