CVE-2026-114732

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
roundcubewebmail
1.6.0 ≤
𝑥
< 1.6.20
CNA
roundcubewebmail
1.7.0 ≤
𝑥
< 1.7.5
CNA
Common Weakness Enumeration
References
https://bugs.debian.org/1151279
https://github.com/roundcube/roundcubemail/commit/453c413d6851cf603bebdb15e58381f5ef9b8094
https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5