Cross-Site Scripting Vulnerability in Roundcube Webmail by Roundcube
CVE-2026-114718

4.7MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114718?

A cross-site scripting vulnerability exists in Roundcube Webmail's password plugin, where error messages from the password driver were improperly handled. This flaw allowed a backend service capable of influencing those messages, like the DirectAdmin API, to inject scripts into the Roundcube user interface. The vulnerability has been addressed in later versions, which now ensure that any driver error messages are properly escaped before being displayed to users, preventing potential exploitation.

Affected Version(s)

Webmail 1.6.0 < 1.6.20

Webmail 1.7.0 < 1.7.5

References

https://bugs.debian.org/1151279
issue-trackingthird-party-advisory
https://github.com/roundcube/roundcubemail/commit/16bbca7...
patch
https://roundcube.net/news/2026/10/19/security-updates-1....
vendor-advisoryrelease-notes

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.