CVE-2026-75010

Executive Summary

CVE-2026-75010 is a token-disclosure vulnerability in the Modoboa driver of the Roundcube Webmail password plugin affecting Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3. An authenticated attacker with low privileges can craft session data that causes the server to leak a Modoboa API authentication token to an attacker-controlled host. The flaw is classified as CWE-669 (Incorrect Resource Transfer Between Spheres) and carries a CVSS score of 6.4 (Medium); it only affects deployments that enable the password plugin with its modoboa driver.

Technical Analysis

The vulnerability resides in the Modoboa driver of the Roundcube Webmail password plugin. The driver is used to synchronize password changes with a Modoboa mail server through the Modoboa API. To authenticate those API calls, the driver relies on an API authentication token that is held in the server-side webmail context. The NVD description states that "crafted session data" can redirect that token to a "user-controlled host," meaning the attacker can influence the destination to which the token is transmitted.

From a vulnerability-class perspective, this maps squarely to CWE-669 — Incorrect Resource Transfer Between Spheres. The trusted resource (the Modoboa API authentication token) lives in a protected server-side sphere, but the application transfers it into a user-controllable sphere (an attacker-owned host) because session-derived values are not sufficiently validated against the legitimate Modoboa API endpoint. The trigger condition is a low-privilege authenticated session (PR:L), the attack is purely network-based (AV:N), requires no user interaction (UI:N), and has low complexity (AC:L). The scope is changed (S:C) because the compromised token belongs to a different security authority (the Modoboa API) than the vulnerable component (the Roundcube instance).

Attack surface: only Roundcube instances running the password plugin with the modoboa driver enabled are affected. Default Roundcube installations that do not enable this driver are not exposed. The severity is limited by the low privilege requirement and the conditional nature of the affected configuration. The CVSS confidentiality and integrity subscores are both Low (C:L/I:L) because the token itself is the primary disclosure and the attacker's ability to act on it depends on the permissions granted to that token within Modoboa.

Insufficient technical detail is available from the NVD description to enumerate the exact parameter names, session keys, or code paths involved. The description, however, makes the mechanism clear: session data — which an authenticated user can manipulate — influences the behavior of the Modoboa driver such that the API token is emitted to a destination outside the trusted API host.

Exploitation Scenarios

No public PoC is available, and the attack chain below is inferred from the vulnerability class and the NVD description. No function names, endpoints, or parameter names are available from the advisory, so the chain is described at the class level.

1. Reconnaissance / target identification. An attacker fingerprinting internet-facing mail infrastructure uses Shodan queries such as http.title:"Roundcube Webmail" or product:"Roundcube" to identify Roundcube installations. The attacker then determines whether the password plugin with the modoboa driver is enabled — for example, by probing the login interface and observing plugin-related behavior or by testing unauthenticated/authenticated endpoints that reveal enabled plugins. Only instances with the modoboa driver are viable targets.

2. Triggering the flaw. The attacker authenticates to the webmail interface with a low-privilege account (CVSS PR:L). Because the vulnerability is triggered by "crafted session data," the attacker manipulates session values that the password plugin's modoboa driver later consults when performing its operation. The manipulation is performed entirely through the web session the attacker already controls — no admin access and no user interaction are required.

3. Execution / token exfiltration. When the modoboa driver runs (for example, during a password-change flow or any operation where the driver contacts the Modoboa API), the server constructs a request to the destination derived from the attacker-influenced session data. Instead of the legitimate Modoboa API host, the token is transmitted to a host controlled by the attacker. The attacker can capture the authentication token from the incoming request.

4. Post-exploitation. With the captured Modoboa API authentication token, the attacker can impersonate the trusted Roundcube integration against the Modoboa API. Depending on the token's granted scope, the attacker may read or modify data exposed by the Modoboa API — the CVSS I:L subscore reflects a limited but real integrity impact. Because the token is stolen rather than guessed, and because it originates from the trusted server component, defenders may not immediately recognize the legitimacy of the attacker's API calls.

Impact Assessment

The business impact is concentrated in three areas:

• Credential exposure. A server-side API authentication token is disclosed to an attacker-controlled host. This token is a persistent credential that, if not rotated, remains usable after the initial leak.
• Cross-system compromise risk. The S:C scope component indicates the token's compromise crosses a trust boundary: the vulnerable component is Roundcube, but the impacted system is the Modoboa API and the data it serves.
• Conditional blast radius. The flaw is not reachable in default Roundcube deployments. Only instances with the password plugin and its modoboa driver enabled are affected. Organizations using Modoboa as their mail backend and Roundcube as the webmail frontend are the primary affected population.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (score 6.4, Medium). The low confidentiality and integrity subscores reflect that the token is a single credential; however, the changed-scope rating and the persistence of API tokens mean the practical impact can exceed the score. There is no CISA KEV listing, no confirmed exploitation in the wild, and no known threat-actor campaigns associated with this CVE at the time of writing.

Detection Guidance

Sigma Rule

This rule detects outbound HTTP requests from the webmail server that match the password/modoboa flow and are destined to hosts other than the legitimate Modoboa API host. Adjust selection.source.ip to the webmail server's subnets and filter_known_api to the accepted Modoboa API FQDN.

title: CVE-2026-75010 - Suspicious Outbound Connection from Roundcube with Modoboa/Password Context
id: 7f3e9c2a-4b81-4f6d-9c0e-2a1b8d5e6f70
status: experimental
description: Detects outbound HTTP requests from a Roundcube webmail server referencing password/modoboa functionality and destined to an unexpected host, which may indicate Modoboa API token exfiltration (CVE-2026-75010).
logsource:
  category: proxy
  product: generic
detection:
  selection:
    source.ip:
      - "10.0.0.0/8"        # placeholder: webmail server subnets
      - "192.168.0.0/16"    # placeholder: webmail server subnets
    http.request.method: POST
    http.url|contains:
      - "modoboa"
      - "password"
  filter_known_api:
    destination.domain|endswith:
      - "modoboa.example.net"
  condition: selection and not filter_known_api
falsepositives:
  - Legitimate password operations reaching the Modoboa API when the destination is not yet allowlisted
  - Proxies that rewrite or obscure the destination domain
level: high

YARA Rule

This rule scans web server access logs, proxy logs, or memory captures for the co-occurrence of modoboa/password context with a token-like value and an external destination pattern.

rule CVE_2026_75010_Modoboa_Token_Leak {
    meta:
        author = "Valters IT SOC"
        description = "Detects log or memory artifacts consistent with Modoboa API token leakage via Roundcube password plugin session data"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75010"
        cve = "2026-75010"
        date = "2026-02-15"
    strings:
        $s1 = "modoboa" ascii wide nocase
        $s2 = "password" ascii wide nocase
        $s3 = "session" ascii wide nocase
        $s4 = /token["' ]{0,3}[:=]["' ]{0,3}[A-Za-z0-9_\-]{16,}/
        $s5 = "POST" ascii wide
    condition:
        all of ($s1, $s2, $s4, $s5) or all of ($s1, $s3, $s4, $s5)
}

Suricata IDS Rule

This rule triggers on outbound HTTP traffic from the webmail server that contains both password and modoboa context in the URI — a strong indicator of the affected plugin flow — when the destination is not the legitimate API host. Adjust $WEBMAIL_SERVER and $EXTERNAL_NET to the deployment's address groups.

alert http $WEBMAIL_SERVER any -> $EXTERNAL_NET any (
    msg:"ET EXPLOIT CVE-2026-75010 Modoboa API Token Leak via Roundcube Password Plugin";
    flow:established,to_server;
    http.uri;
    content:"password"; http.uri;
    content:"modoboa"; http.uri;
    http.method;
    content:"POST"; http.method;
    classtype:attempted-user;
    reference:cve,2026-75010;
    sid:202675010;
    rev:1;)

Elastic Detection

This EQL rule identifies egress HTTP/network events from the webmail server with password-context URLs that are not destined for the approved Modoboa API host.

network where network.direction == "egress"
    and source.ip in ("<webmail_server_ip>")
    and url.path like "*password*"
    and not destination.domain in ("<modoboa_api_fqdn>")

Complementary EQL for web server logs:

any where event.module == "apache" or event.module == "iis"
    and url.path like "*password*"
    and url.query like "*modoboa*"
    and not user.name in ("<service-account>")

Splunk SPL Query

Search proxy/firewall logs for server-initiated connections to unexpected destinations with password/modoboa context:

index=network_stream (sourcetype=pan:traffic OR sourcetype=stream:http)
| search src_ip="<webmail-server-ip>" http_method=POST
| search url="*password*" OR url="*modoboa*"
| search NOT dest_host="<modoboa-api-fqdn>"
| stats count min(_time) max(_time) by src_ip dest_ip dest_host url http_method
| sort - count

Additional hunt in web access logs for abnormal plugin invocation patterns:

index=web sourcetype=apache_access
| search uri_query="*modoboa*" uri_query="*password*"
| table _time clientip method uri uri_query status bytes
| sort _time

Wazuh OSSEC Rule

This Wazuh rule fires on web access log lines that combine the modoboa and password markers, signaling a possible exploitation attempt or token leak event.

<group name="roundcube,">
  <rule id="100750" level="12">
    <decoded_as>web-access</decoded_as>
    <match>modoboa</match>
    <match>password</match>
    <description>CVE-2026-75010: Possible Modoboa API token leak via Roundcube password plugin (modoboa driver).</description>
    <group>cve-2026-75010,roundcube,credential_access,</group>
    <info type="cve">CVE-2026-75010</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this CVE is 0/4 — UNPATCHED, meaning no tracked source has confirmed an official patch advisory. The NVD description identifies Roundcube 1.6.18 and 1.7.3 as the boundary versions, which implies those releases contain the fix; however, given the lack of confirmed patch evidence, organizations must verify the fix with their vendor before relying on an upgrade.

1. Immediate mitigations.

   • If the password plugin's modoboa driver is not required, disable the driver or the plugin entirely in the Roundcube configuration.
   • Apply strict egress firewall allowlisting on the webmail server so that only the legitimate Modoboa API host and port are reachable. This neutralizes exfiltration regardless of session-data manipulation.
   • Monitor and alert on any server-side outbound HTTP requests that do not match the approved Modoboa API destination.
   • Rotate the Modoboa API authentication token immediately if any suspicious outbound connection has been observed.

2. Patch / upgrade steps.

   • Upgrade Roundcube Webmail to 1.6.18 or 1.7.3 (per the NVD version boundary) once the fix is confirmed with the Roundcube project or your distribution vendor.
   • Re-verify the affected configuration after upgrade: confirm the password plugin and modoboa driver behave as expected and that session data no longer influences the token destination.
   • Since patch confidence is 0/4, treat the upgrade as necessary but not sufficient — validate the specific fix in the release notes before declaring the CVE remediated.

3. Long-term hardening.

   • Segment the webmail tier from the mail/API backend using internal network controls so that token-bearing traffic cannot transit untrusted links.
   • Enforce TLS with strong certificate validation on the Modoboa API client connection to resist interception and impersonation.
   • Implement routine token rotation for all API credentials, and reduce token scope to the minimum operations the password plugin must perform.
   • Subscribe to Roundcube security advisories and re-evaluate this CVE as patch status updates; track the CISA KEV list for any future change in exploitation status.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75010
• MITRE CWE-669 (Incorrect Resource Transfer Between Spheres): https://cwe.mitre.org/data/definitions/669.html
• MITRE ATT&CK T1552 (Unsecured Credentials): https://attack.mitre.org/techniques/T1552/
• Roundcube Webmail Project (source and release information): https://github.com/roundcube/roundcubemail
• FIRST EPSS (score not yet published for this CVE): https://www.first.org/epss/

No CISA KEV listing exists for CVE-2026-75010, no public exploit code or Nuclei template has been identified, and no threat-actor campaigns or exploit-in-the-wild evidence have been confirmed at the time of this report.