CVE-2017-8114: Roundcube Webmail

High severity, CVSS 8.8. EPSS: 3.5% chance of exploitation in the next 30 days.

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

Affected products

• Roundcube Webmail: before 1.0.11 (fixed in 1.0.11); from 1.1.0, before 1.1.9 (fixed in 1.1.9); from 1.2.0, before 1.2.5 (fixed in 1.2.5)

Published 2017-04-29. Last modified 2026-06-17.