CVE-2026-75010

Katalog CVE

CVSS 4.3 · Medium EPSS 0,39%

Kerentanan Incorrect Resource Transfer Between Spheres pada roundcube webmail. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver.

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-669: Incorrect Resource Transfer Between Spheres

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/65b8ea9d8304b10f1d3bda5bcc82f9c682cf804c patch
• https://github.com/roundcube/roundcubemail/commit/b0e26d617e7bbe3051135285993bc55f718fea2f patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 release notes