CVE-2026-35541CWE-843

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14

Medium · published April 3, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.9th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2026-04-03T03:50Z
EPSS history
Timeline
  • 03 APR 03:50Z
    An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
    cvelistv5