What is the CVSS score of CVE-2026-35541?

CVE-2026-35541 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35541?

Yes, a patch is available for CVE-2026-35541. Update the affected software to the latest version immediately.

Webmail CVE-2026-35541

EUVD-2026-18585 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-04-03 mitre

GHSA-46pv-mj2g-93gh

Information Disclosure Memory Corruption Webmail

4.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 04, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 03, 2026 - 04:30 euvd

EUVD-2026-18585

Analysis Generated

Apr 03, 2026 - 04:30 vuln.today

CVE Published

Apr 03, 2026 - 03:50 nvd

MEDIUM 4.2

DescriptionCVE.org

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.

AnalysisAI

Type confusion in Roundcube Webmail's password plugin allows authenticated users to change passwords without knowing the old password, affecting versions before 1.5.14 and 1.6.14. The vulnerability stems from incorrect password comparison logic that enables privilege escalation within an authenticated session. While the CVSS score of 4.2 reflects moderate severity and the requirement for prior authentication, the impact is direct account compromise for any authenticated user.

Technical ContextAI

The vulnerability exploits CWE-843 (Type Confusion), a class of flaw where PHP's loose type comparison (== operator) can equate dissimilar types incorrectly, particularly in password validation contexts. The password plugin in Roundcube uses insufficient type-checking when comparing user-supplied old passwords against stored credentials, permitting a type confusion attack. An authenticated user can craft a password change request where the old password comparison short-circuits due to type juggling, allowing the attacker to set a new password without providing the correct original password. This affects Roundcube Webmail across all 1.x versions prior to the patched releases (1.5.14, 1.6.14, and 1.7-rc5), as identified in the CPE string cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*. The flaw is specific to the password change feature and is not a general authentication bypass but a privilege escalation within an existing session.

RemediationAI

Vendor-released patches are available: upgrade Roundcube Webmail to version 1.5.14, 1.6.14, or later. Users on 1.5.x branch should upgrade to 1.5.14; users on 1.6.x branch should upgrade to 1.6.14. The fix is committed in the official GitHub repository at https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 and https://github.com/roundcube/roundcubemail/releases/tag/1.5.14, with underlying code corrections in commits 6fa2bddc59b9c9fd31cad4a9e2954a208d793dce and 2e6a99b2a38110907ea8d3be8e59ec3d5802c394 respectively. No workaround is documented; patching is mandatory to close the type confusion vulnerability in the password plugin.