CVE-2026-75010 is a vulnerability in Roundcube Webmail's password plugin modoboa driver in versions prior to 1.6.18 and 1.7.3. It allows an attacker to leak a Modoboa API authentication token by manipulating session data, potentially exposing sensitive authentication credentials to an attacker-controlled host. This issue is limited to Roundcube instances using the password plugin with the modoboa driver and does not affect other configurations.

The vulnerability can lead to the leakage of a Modoboa API authentication token, which may allow an attacker with low privileges to gain unauthorized access to Modoboa API functions. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users of Roundcube Webmail should verify if they are using the password plugin with the modoboa driver and upgrade to versions 1.6.18 or later, or 1.7.3 or later, once official fixes are released. Until then, consider disabling the modoboa driver in the password plugin if feasible.