Roundcube Webmail allows arbitrary password resets by authenticated
users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and
1.2.x before 1.2.5. The problem is caused by an improperly restricted
exec call in the virtualmin and sasl drivers of the password plugin.
Created roundcubemail tracking bugs for this issue:
Affects: epel-6 [bug 1448401]
This was fixed 3 years ago. Closing.