EUVD-2026-18585
GHSA-46pv-mj2g-93gh
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N indicates remote network attack requiring an existing authenticated session (PR:L), high attack complexity, and limited confidentiality and integrity impact without availability impact. The moderate CVSS score of 4.2 accurately reflects the authentication prerequisite; an attacker must already have credentials or a valid session. However, the real-world risk is elevated because compromising a password change feature post-authentication enables account takeover once the attacker gains any user session (phishing, social engineering, credential leak, or session hijacking). The tags 'Information Disclosure' and 'Memory Corruption' suggest potential information leakage during the type confusion process. No public exploit code or CISA KEV status is indicated in the available data, reducing immediate exploitation pressure. The SSVC framework assessment favors prioritization due to technical impact (account compromise) and automatable exploitation (no user interaction required beyond authentication), despite the authentication gate. Organizations with multi-user Roundcube instances face meaningful risk if users reuse passwords or if attackers gain low-privilege access. |
| Exploit ScenarioDerived | An authenticated user with a valid Roundcube session (or an attacker who has obtained a user's session token through phishing or credential compromise) accesses the password change feature in the webmail interface. The attacker submits a password change request with an arbitrary string for the 'old password' field; due to the type confusion flaw, the server's loose comparison incorrectly validates this incorrect old password as correct, permitting the attacker to set a new password without the original password. With the new password set, the attacker retains access to the account indefinitely. No public exploit code is identified in the analysis, but the high attack complexity stems from requiring prior authentication rather than technical exploitation difficulty. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Type confusion in Roundcube Webmail's password plugin allows authenticated users to change passwords without knowing the old password, affecting versions before 1.5.14 and 1.6.14. The vulnerability stems from incorrect password comparison logic that enables privilege escalation within an authenticated session. While the CVSS score of 4.2 reflects moderate severity and the requirement for prior authentication, the impact is direct account compromise for any authenticated user.
RemediationAI
Vendor-released patches are available: upgrade Roundcube Webmail to version 1.5.14, 1.6.14, or later. Users on 1.5.x branch should upgrade to 1.5.14; users on 1.6.x branch should upgrade to 1.6.14. The fix is committed in the official GitHub repository at https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 and https://github.com/roundcube/roundcubemail/releases/tag/1.5.14, with underlying code corrections in commits 6fa2bddc59b9c9fd31cad4a9e2954a208d793dce and 2e6a99b2a38110907ea8d3be8e59ec3d5802c394 respectively. No workaround is documented; patching is mandatory to close the type confusion vulnerability in the password plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exploits CWE-843 (Type Confusion), a class of flaw where PHP's loose type comparison (== operator) can equate dissimilar types incorrectly, particularly in password validation contexts. The password plugin in Roundcube uses insufficient type-checking when comparing user-supplied old passwords against stored credentials, permitting a type confusion attack. An authenticated user can craft a password change request where the old password comparison short-circuits due to type juggling, allowing the attacker to set a new password without providing the correct original password. This affects Roundcube Webmail across all 1.x versions prior to the patched releases (1.5.14, 1.6.14, and 1.7-rc5), as identified in the CPE string cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*. The flaw is specific to the password change feature and is not a general authentication bypass but a privilege escalation within an existing session.
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Roundcube Webmail Multiple Vulnerabilities
View all 8Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
Exploit-DB