CVE-2026-114732
published 2026-10-22CVE-2026-114732: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in…
PriorityP342medium6.8CVSS 3.1
AVNACHPRLUINSUCHIHAN
EPSS
0.36%
28.4th percentile
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundcube | webmail | >= 1.6.0 < 1.6.20 | 1.6.20 |
| roundcube | webmail | >= 1.7.0 < 1.7.5 | 1.7.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments
bugzilla·2026-10-22·CVSS 6.8
CVE-2026-114732 [MEDIUM] CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments
CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.
Bugzilla
CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments [fedora-all]
bugzilla·2026-10-22·CVSS 6.8
CVE-2026-114732 [MEDIUM] CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments [fedora-all]
CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’
Bugzilla
CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments [epel-all]
bugzilla·2026-10-22·CVSS 6.8
CVE-2026-114732 [MEDIUM] CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments [epel-all]
CVE-2026-114732 roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t
https://bugs.debian.org/1151279https://github.com/roundcube/roundcubemail/commit/453c413d6851cf603bebdb15e58381f5ef9b8094https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61dddhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.20https://github.com/roundcube/roundcubemail/releases/tag/1.7.5https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
2026-10-22
Published