IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.8Mittel

CVE-2026-114715

Roundcube Webmail Veröffentlicht: (vor 24 Tagen)

Beschreibung

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.

Schwachstellentyp (CWE): CWE-863

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Roundcube Webmail 1.6.0 – < 1.6.20, 1.7.0 – < 1.7.5

Referenzen und Patches

CPE-Treffer (NVD) (2)
  • cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* ≥ 1.6.0 < 1.6.20
  • cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* ≥ 1.7.0 < 1.7.5

Neue CVEs im selben Produkt — Roundcube Webmail

6.8Mittel
CVE-2026-114732
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qua…

5.3Mittel
CVE-2026-114731
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, s…

7.2Hoch
CVE-2026-114730
Roundcube Webmail

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 pr…

5.3Mittel
CVE-2026-114729
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remot…

5.3Mittel
CVE-2026-114728
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so valu…