CVE-2026-114732 in Roundcube
Summary
by MITRE • 10/23/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 represents a critical authentication bypass flaw specific to multi-host deployment architectures. In these configurations, the application is designed to manage user identities across multiple distinct IMAP mail servers. The core technical failure resides within the rcube_user::query() function, which handles the resolution of user credentials during the login process. When an administrator or system configuration defines email aliases for users, this function attempts to match the provided alias address against existing identity records in the database. However, the implementation fails to include the IMAP host identifier as a qualifying parameter in the SQL lookup query. This omission means that when a user authenticates using an alias, the application searches the entire global pool of identities without restricting the search scope to the specific mail server associated with that account.
This architectural oversight leads to a scenario where credentials intended for one domain or IMAP host can inadvertently resolve to a valid user account hosted on a completely different IMAP server within the same Roundcube installation. For instance, if an alias is configured such that it overlaps in format or exists as a duplicate entry across two separate mail hosts, the authentication logic may successfully validate the password against the wrong backend service. Consequently, an attacker who possesses valid credentials for one host can potentially gain access to accounts on another host simply by utilizing an aliased email address that maps incorrectly due to the missing host qualification in the database query. This effectively circumvents the isolation boundaries intended between different mail servers managed by a single Roundcube instance.
The operational impact of this vulnerability is severe, particularly for organizations relying on multi-tenant or distributed mail infrastructure where strict separation of duties and data isolation are required. Successful exploitation allows an unauthorized user to access email accounts they do not own, leading to potential confidentiality breaches including the exposure of sensitive communications, personal identifiable information, and corporate secrets. Furthermore, this flaw undermines the integrity of the authentication system by allowing credential reuse across isolated environments that should remain distinct. It also complicates forensic analysis and audit trails, as login events may be attributed to incorrect user identities or hosts, obscuring the true source of malicious activity.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, specifically involving issues where authentication credentials are not properly validated against all relevant contextual parameters such as host identity. It also relates to CWE-640, Weak Password Recovery Mechanism for Forgotten Password, in contexts where alias resolution might be exploited during recovery flows, though the primary vector is direct login bypass. In terms of offensive security frameworks, this flaw facilitates Initial Access via Valid Accounts and could potentially lead to Lateral Movement if an attacker uses compromised credentials from one host to pivot into another network segment or service managed by the same Roundcube instance.
To mitigate this risk, organizations running affected versions must immediately upgrade to Roundcube Webmail version 1.6.20 or later for the stable branch, and version 1.7.5 or later for the development branch. The upstream developers addressed this issue in a commit explicitly titled Fix bug where an alias login wasn’t qualified by IMAP host, which corrects the SQL query to include the necessary host identifier during identity resolution. Until upgrades are applied, administrators should consider implementing additional access controls at the reverse proxy or web server level to restrict authentication attempts based on source IP ranges if possible, although this is a less effective compensating control than patching the application itself. Regular security audits of alias configurations and monitoring for anomalous login patterns across different IMAP hosts can also help in detecting potential exploitation attempts while mitigation measures are being deployed.