Threats tagged 'ghsa-x46g-hj4c-2cgc'

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain an incorrect authorization vulnerability in the Modoboa driver of the password plugin. This flaw allows a password change request to be applied to a different account because the driver used the first account returned by the Modoboa API search instead of verifying the authenticated user. The issue has been fixed upstream by ensuring the driver matches the username exactly and fails if no match is found.