CVE-2026-35541 - An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14

Back Back to CVE browser

MEDIUM

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14

Published Apr 3, 2026

4.2

MEDIUM

CVSS 3.1

EPSS 0.31%

Description

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.

Affected products

Vendor Roundcube Product Webmail Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.5.14
- Version
  1.6.0
  Status
  affected
  Constraints
  <1.6.14

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Roundcube

Webmail

unaffected

Version	Status	Constraints
0	affected	<1.5.14
1.6.0	affected	<1.6.14

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-843

References (10)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18585		Advisory
https://github.com/advisories/GHSA-46pv-mj2g-93gh		Advisory
https://github.com/roundcube/roundcubemail/commit/2e6a99b2a38110907ea8d3be8e59ec3d5802c394		Patch
https://github.com/roundcube/roundcubemail/commit/6a275676a8043083c05c961914d830b79e2490d4		Patch
https://github.com/roundcube/roundcubemail/commit/6fa2bddc59b9c9fd31cad4a9e2954a208d793dce		Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.5.14		Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.14		Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5		Release Notes
https://nvd.nist.gov/vuln/detail/CVE-2026-35541
https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14		Vendor Advisory