CVE-2026-35541
Roundcube Webmail: Incorrect password comparison in the password plugin
CVE-2026-35541 is a medium vulnerability (CVSS 4.2) in Bulwarkmail Webmail, published April 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in roundcube/roundcubemail 1.7-rc5.
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- Record
CVE-2026-35541- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-843
- Updated
- 2026-11-02
EUVDEUVD-2026-18585
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- Record
EUVD-2026-18585- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-46pv-mj2g-93gh
Roundcube Webmail: Incorrect password comparison in the password plugin
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- Record
GHSA-46pv-mj2g-93gh- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-843
- Updated
- 2026-11-02
NVD
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- Record
CVE-2026-35541- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-843
- Updated
- 2026-11-02
OSV
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- Record
CVE-2026-35541- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-843
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-35541
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- Record
DEBIAN-CVE-2026-35541- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-46pv-mj2g-93gh
Roundcube Webmail: Incorrect password comparison in the password plugin
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- Record
GHSA-46pv-mj2g-93gh- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-843
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-35541
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
- Record
UBUNTU-CVE-2026-35541- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcube/roundcubemailPackagist |
1.7-beta up to 1.7-rc5 | 1.7-rc5 |
roundcubeDebian:12 |
before 1.6.5+dfsg-1+deb12u8, plus listed versions 1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2 Show 10 moreShow less1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1+deb12u31.6.5+dfsg-1+deb12u41.6.5+dfsg-1+deb12u51.6.5+dfsg-1+deb12u61.6.5+dfsg-1+deb12u71.6.5+dfsg-1~deb12u1 |
1.6.5+dfsg-1+deb12u8 |
roundcubeDebian:13 |
before 1.6.15+dfsg-0+deb13u1, plus listed versions 1.6.11+dfsg-11.6.12+dfsg-0+deb13u11.6.12+dfsg-11.6.13+dfsg-0+deb13u11.6.13+dfsg-11.6.14+dfsg-1 |
1.6.15+dfsg-0+deb13u1 |
roundcubeDebian:14 |
before 1.6.14+dfsg-1, plus listed versions 1.6.11+dfsg-11.6.12+dfsg-11.6.13+dfsg-1 |
1.6.14+dfsg-1 |
roundcube/roundcubemailPackagist |
1.7-beta up to 1.7-rc5, plus listed versions 1.7-beta21.7-rc1.7-rc21.7-rc31.7-rc4 |
1.7-rc5 |
roundcubeUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1 Show 8 moreShow less1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm61.2~beta+dfsg.1-0ubuntu1+esm71.2~beta+dfsg.1-0ubuntu1+esm8 |
None known |
roundcubeUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-1 Show 8 moreShow less1.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm31.3.6+dfsg.1-1ubuntu0.1~esm41.3.6+dfsg.1-1ubuntu0.1~esm51.3.6+dfsg.1-1ubuntu0.1~esm61.3.6+dfsg.1-1ubuntu0.1~esm71.3.6+dfsg.1-1ubuntu0.1~esm8 |
None known |
roundcubeUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2 Show 9 moreShow less1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm61.4.3+dfsg.1-1ubuntu0.1~esm71.4.3+dfsg.1-1ubuntu0.1~esm8 |
None known |
roundcubeUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm51.5.0+dfsg.1-2ubuntu0.1~esm6 |
None known |
roundcubeUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-2 Show 4 moreShow less1.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm21.6.6+dfsg-2ubuntu0.1+esm3 |
None known |
roundcubeUbuntu:25.10 |
All versions, plus listed versions 1.6.10+dfsg-11.6.10+dfsg-21.6.11+dfsg-1 |
None known |
roundcubeUbuntu:26.10 |
All versions, plus listed versions 1.6.11+dfsg-1 |
None known |
roundcubeUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 1.6.11+dfsg-11.6.11+dfsg-1ubuntu0.26.04.1~esm1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14
github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-35541
security-tracker.debian.org/tracker/CVE-2026-35541
ubuntu.com/security/CVE-2026-35541
cve.org/CVERecord?id=CVE-2026-35541