Roundcube Webmail: Incorrect password comparison in the password plugin
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-35541US | — | — | ||
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password chan… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/roundcube/roundcubemailPACKAGE
- https://github.com/roundcube/roundcubemail/commit/2e6a99b2a38110907ea8d3be8e59ec3d5802c394WEB
- https://github.com/roundcube/roundcubemail/commit/6a275676a8043083c05c961914d830b79e2490d4WEB
- https://github.com/roundcube/roundcubemail/commit/6fa2bddc59b9c9fd31cad4a9e2954a208d793dceWEB
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.14WEB
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.14WEB
- https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-35541ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan