Live › vulnerability › CVE-2026-114732
Go to dashboardRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 looks up alias logins without matching the IMAP host, so a login can resolve to a user account on a different IMAP host. An attacker may be able to log in as a user from another host in a multi-host installation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations that run Roundcube against more than one IMAP host and let users sign in with alias addresses are exposed, since the alias lookup ignores which host the account belongs to. Single-host installations are unlikely to be affected by the cross-host mix-up, though the sources do not say this explicitly. Teams on the fixed versions can skip it.
No product ranges from the sources yet.
bin/roundcube or the Roundcube about page; versions below 1.6.20 on the 1.6 line, or below 1.7.5 on the 1.7 line, are in scopedefault_host or imap_host arrays in config)1.6.20 or later on the 1.6 line, or 1.7.5 or later on the 1.7 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.
This page as .md · .json · in your agent: get_signal("CVE-2026-114732")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.