Roundcube and Horde isnt the same as SOGo or Zarafa, they are different applications.
Roundcube and Horde is webmail interfaces.
SOGo or Zarafa is collaboration applications with mail, calendar and more.
AFAIK Horde has this all as well... they are all web based Groupware solutions IIRC.
That is right, SOGo, Zarafa and it seems Horde all can do a LOT more than just webmail. But that adds complexity too. I think this is a case of sometimes "less is more"! Even if the "complexity" is just perceived by the user, it is real to them. These guys work in such a small team, on such a narrow task, they don't even need a calendar.
Your best option is to raise a bug in the contribs bug tracker and post all the details including any security risks.
Thanks, I'll give this a try, but I've only heard rumors really (about the security risks) and don't know what the details are yet.
Cheers,
Rishi.