CVE-2026-114732

mediumpriority · track · 0OT risk · elevatedEPSS 0.004 · 28 %ileUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.36% (28th) EPSS

CVSS 6.8 · medium

Is it mine?

0 products

Check your exposure

Who says so?

— sources

EPSS · scored 2026-10-23

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.

cvss

Technical severity, 0–10. One row per scoring source.

6.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · cve@mitre.org USexploitability 1.6 · impact 5.2

v3.16.2mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-288USprimaryCWE-288US

affected products

Products and version ranges known to be affected.

No affected products recorded.

sources

Which sources assert this record, and when.

NVD CVE.org MITRE

published 2026-10-22modified 2026-10-22

related (776)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-19490US	critical9.8OT critical	23.2% (98th)	KEV	2026-08-19
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 t…
CVE-2026-18577US	high8.1OT critical	14.6% (97th)	KEV	2026-08-02
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
CVE-2026-18556US	high7.4OT critical	7.88% (95th)	KEV	2026-08-01
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.
CVE-2026-20079US	—OT critical	88.5% (100th)	KEV	2026-03-04
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute…
CVE-2026-1603US	high7.5OT critical	88.3% (100th)	KEV	2026-02-10
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

+771 more

references (6) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan