{"id":"CVE-2026-114732","kind":"vulnerability","aliases":["CVE-2026-114732"],"related":[],"title":"Roundcube Webmail: alias login can resolve to a user on another IMAP host","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.","summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 looks up alias logins without matching the IMAP host, so a login can resolve to a user account on a different IMAP host. An attacker may be able to log in as a user from another host in a multi-host installation.","severity":"medium","cvss":6.8,"epss":0.00358,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","multi-host","package","roundcube","self-hosted"],"not_affected_if":["patched-version","single-imap-host"],"how_to_check":"- Check the installed version with `bin/roundcube` or the Roundcube about page; versions below `1.6.20` on the 1.6 line, or below `1.7.5` on the 1.7 line, are in scope\n- Confirm whether the installation serves several IMAP hosts (multi-host `default_host` or `imap_host` arrays in config)","fix":"- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6 line, or `1.7.5` or later on the 1.7 line\n- Apply the upstream commit “Fix bug where an alias login wasn’t qualified by IMAP host” if an immediate upgrade is not possible","status":"open","published_at":"2026-10-22T03:16:38+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:42:52+00:00","updated_at":"2026-10-25T03:42:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:42:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6 line, or `1.7.5` or later on the 1.7 line\n- Apply the upstream commit “Fix bug where an alias login wasn’t qualified by IMAP host” if an immediate upgrade is not possible","reach":"internet","title":"Roundcube Webmail: alias login can resolve to a user on another IMAP host","impact":"high","summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 looks up alias logins without matching the IMAP host, so a login can resolve to a user account on a different IMAP host. An attacker may be able to log in as a user from another host in a multi-host installation.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","email","multi-host"],"confidence":0.5,"needs_auth":"unknown","worst_case":"login resolves to another host's user account","analyst_note":"Sources give no exploit details or confirmed reach; check the upstream commit for the exact trigger and whether a password is still required.","how_to_check":"- Check the installed version with `bin/roundcube` or the Roundcube about page; versions below `1.6.20` on the 1.6 line, or below `1.7.5` on the 1.7 line, are in scope\n- Confirm whether the installation serves several IMAP hosts (multi-host `default_host` or `imap_host` arrays in config)","needs_analyst":true,"not_affected_if":["single-imap-host","patched-version"],"who_is_affected":"Installations that run Roundcube against more than one IMAP host and let users sign in with alias addresses are exposed, since the alias lookup ignores which host the account belongs to. Single-host installations are unlikely to be affected by the cross-host mix-up, though the sources do not say this explicitly. Teams on the fixed versions can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":3431,"output_tokens":687,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114732':16A,19A '-2026':15A,18A '1.6.20':32B,84C '1.7':34B,86C '1.7.5':37B,89C 'abl':65B 'account':55B,136C 'address':110C,116C 'affect':91C 'alia':3A,40B,109C,153C 'anoth':11A,73B 'attack':62B 'authent':95C 'belong':137C 'bug':150C 'commit':148C 'could':130C 'cve':14A,17A 'differ':58B,140C 'email':20B 'fix':144C,149C 'host':13A,23B,28B,46B,60B,74B,79B,100C,126C,142C,160C 'ident':118C 'imap':12A,45B,59B,125C,141C,159C 'improp':94C 'instal':80B,101C 'log':67B,105C 'login':4A,41B,49B,129C,154C 'look':38B 'lookup':123C 'match':43B,114C 'may':63B 'multi':22B,78B,99C 'multi-host':21B,77B,98C 'packag':24B 'qualifi':121C,157C 'queri':113C 'rcube':111C 'record':119C 'resolv':6A,51B,132C 'roundcub':1A,25B,29B,81C 'self':27B 'self-host':26B 'upstream':143C 'user':9A,54B,71B,104C,112C,135C 'vulner':96C 'wasn':155C 'webmail':2A,30B,82C 'without':42B,120C 'x':35B,87C","nicknames":[],"mitigations":[],"who_affected":"Installations that run Roundcube against more than one IMAP host and let users sign in with alias addresses are exposed, since the alias lookup ignores which host the account belongs to. Single-host installations are unlikely to be affected by the cross-host mix-up, though the sources do not say this explicitly. Teams on the fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T03:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114732","severity":null,"published_at":"2026-10-22T03:16:38+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114732","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114732","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}