CVE-2026-114732

6.8 Moyenne

Publiée le 22/10/2026 à 05:16 · Modifiée le 22/10/2026 à 05:16 · Reçue · Source : cve@mitre.org

Description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.

Traduire en français

Produits concernés

Roundcube Webmail

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.8 Moyenne	cve@mitre.org	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-288

Références

https://bugs.debian.org/1151279
https://github.com/roundcube/roundcubemail/commit/453c413d6851cf603bebdb15e58381f5ef9b8094
https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories