UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114732

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in…

Severity
Medium 6.8
Published
22 Oct 2026
Last changed
29 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
CVE Program

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cna:roundcube|webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114732