This vulnerability in Roundcube Webmail arises from a type confusion (CWE-843) in the password plugin's password comparison logic. Specifically, the incorrect comparison allows bypassing the requirement to know the old password when changing it. Affected versions include all releases before 1.5.14 and 1.6.14. The CVSS 3.1 base score is 4.2, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact. No official fix or patch has been documented in the provided data.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to change a user's password without knowing the current password. This could lead to unauthorized account access or takeover. The impact on confidentiality and integrity is limited but notable, while availability is not affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected Roundcube Webmail instances and monitor for suspicious password changes. Avoid relying solely on the password plugin for authentication security. Follow vendor updates closely for patches or official mitigations.