Roundcube Webmail: Incorrect password comparison in the password plugin
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-35541US | — | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password chan… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/roundcube/roundcubemailPACKAGE
- https://github.com/roundcube/roundcubemail/commit/2e6a99b2a38110907ea8d3be8e59ec3d5802c394WEB
- https://github.com/roundcube/roundcubemail/commit/6a275676a8043083c05c961914d830b79e2490d4WEB
- https://github.com/roundcube/roundcubemail/commit/6fa2bddc59b9c9fd31cad4a9e2954a208d793dceWEB
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.14WEB
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.14WEB
- https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-35541ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan