{"action":"Upgrade roundcube to 1.6.20+dfsg-0+deb13u1 or later.","affected":[{"fixed":"1.6.20+dfsg-0+deb13u1","introduced":"0"}],"component":"roundcube","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.6.20+dfsg-0+deb13u1"],"id":"tcs_01M5NQBGHW7FGK5QX7QPDPCB6E","modified_at":"2026-10-23T18:02:33.745080648Z","published_at":"2026-10-22T02:16:58.930Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-114715","https://security-tracker.debian.org/tracker/CVE-2026-114715"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-114715#Debian:13/roundcube","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-114715"}],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the acco"}