Improper Authentication in Roundcube Webmail - #VU156138
Published: October 19, 2026
Vulnerability identifier: #VU156138
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause an alias login to be associated with an incorrect IMAP host context, potentially permitting unauthorized account access.
The vulnerability exists due to insufficient qualification of alias login identities in the login handling logic when resolving an alias against an IMAP host. A remote user can use an alias login whose host context is not properly distinguished to potentially cross an account identity boundary.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.20, 1.7.5