In Roundcube Webmail versions 1.6.0 and 1.7.0, the modoboa driver of the password plugin can leak a Modoboa API authentication token through crafted session data to a user-controlled host. This vulnerability is classified as CWE-669 (Incorrect Resource Transfer Between Spheres). The leak could allow an attacker with limited privileges to obtain authentication tokens, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and scope change with partial confidentiality and integrity impact but no availability impact. No known exploits in the wild or vendor patches have been reported as of the publication date.

An attacker able to manipulate session data in affected Roundcube Webmail instances using the password plugin with the modoboa driver could leak Modoboa API authentication tokens to a host they control. This could lead to partial confidentiality and integrity compromise of the affected system's authentication tokens. There is no indication of availability impact or widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should monitor vendor communications for updates. If possible, avoid using the password plugin with the modoboa driver until a fix is available or apply any recommended temporary mitigations from the vendor.