CVE-2026-35541

MediumCVSS 4.2

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

Roundcube Webmail before versions 1.5.14 and 1.6.14 has incorrect password comparison in the password plugin, leading to type confusion that allows password change without knowing the old password.

Risk Assessment

An attacker can change a user's password without authorization, taking over the email account.

Recommendation

Update Roundcube Webmail to version 1.5.14 or 1.6.14.

Original NVD description (English source)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.