CVE-2007-6018: Horde Framework

Medium severity, CVSS 5.8. EPSS: 1.8% chance of exploitation in the next 30 days.

IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.

Affected products

• Horde Framework: version 3.1.5 only
• Horde Groupware Webmail Edition: version 1.0.3 only
• Horde Horde: version 3.1.5 only
• Horde Imp: version 4.1.5 only

Published 2008-01-11. Last modified 2026-06-16.