Roundcube Webmail EUVD-2026-107999

Exploitation is limited to multi-host Roundcube installations (multiple IMAP hosts configured on one instance) where alias/identity addresses can collide across hosts; single-host deployments are not affected. The attacker must be able to perform an authenticated login using an alias address (PR:L) that matches an identity record belonging to a user on a different IMAP host - so a cross-host email/alias collision must exist. CVSS AC:H reflects this dependence on specific configuration and collision conditions; no user interaction from the victim is required (UI:N), and only confidentiality and integrity of the mis-resolved mailbox are impacted (A:N).

This is a moderate-severity, condition-gated authentication flaw rather than a mass-exploitation priority. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, base 6.8) is internally consistent with the description: network-reachable (webmail login), but AC:H because exploitation depends on a specific multi-host configuration and an alias/email collision across IMAP hosts, and PR:L because the actor must still complete an authenticated login. No KEV listing is present in the input, so this is NOT confirmed actively exploited. No POC/exploit code is referenced, so there is no public exploit identified at time of analysis. EPSS and SSVC data were not supplied, so probabilistic exploitation likelihood and the automatable/technical-impact decision inputs cannot be factored in - treat any 'likelihood' claim as unknown. The signals that ARE available point the same direction: a real but narrow risk (account takeover across tenants) that only materializes in multi-host deployments, which tempers the high C/I impact. Net: a legitimate fix-worthy issue for multi-tenant/hosting operators, but not a drop-everything internet-wide emergency given AC:H, the multi-host prerequisite, and the absence of KEV/POC/EPSS evidence of active or probable exploitation.

In a Roundcube multi-host installation serving several IMAP hosts, an attacker authenticates using an alias address that collides with an identity record belonging to a user on a different IMAP host; because rcube_user::query() matched on email without qualifying by mail_host, the login resolves to that other host's account, granting access to the victim's mailbox. No public exploit code is referenced in the available data; the fix adds an IMAP-host qualifier to the lookup query.