Improper Authentication Vulnerability in Roundcube Webmail by Roundcube
CVE-2026-114732

6.8MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114732?

Roundcube Webmail prior to version 1.6.20 and 1.7.x prior to 1.7.5 is susceptible to an improper authentication vulnerability in multi-host deployments. This flaw permits a user to log in with an alias address, which is matched against identity records without considering the IMAP host. Consequently, this could direct a login attempt to an account associated with a different IMAP host. The issue has been addressed through a recent update which enhances the login process by ensuring that alias lookups are properly qualified by IMAP host specifics.

Affected Version(s)

Webmail 1.6.0 < 1.6.20

Webmail 1.7.0 < 1.7.5

References

https://bugs.debian.org/1151279
issue-trackingthird-party-advisory
https://github.com/roundcube/roundcubemail/commit/453c413...
patch
https://roundcube.net/news/2026/10/19/security-updates-1....
vendor-advisoryrelease-notes

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.