PT-2026-29980 · Roundcube+1 · Roundcube Webmail+1

Y0Us · Published 2026-03-17 · Updated 2026-05-07 · CVE-2026-35541

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.5.14 and prior to 1.6.14

Description A flaw exists in Roundcube Webmail where an incorrect password comparison within the password plugin can cause a type confusion. This could allow a password change without knowledge of the original password.

Recommendations Update Roundcube Webmail to version 1.5.14 or later. Update Roundcube Webmail to version 1.6.14 or later.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2026-06303

CVE-2026-35541

GHSA-46PV-MJ2G-93GH

Affected Products

Red Os

Roundcube Webmail

References · 20

• https://github.com/roundcube/roundcubemail/commit/2e6a99b2a38110907ea8d3be8e59ec3d5802c394 · Patch
• https://github.com/roundcube/roundcubemail/commit/6fa2bddc59b9c9fd31cad4a9e2954a208d793dce · Patch
• https://github.com/roundcube/roundcubemail/commit/6a275676a8043083c05c961914d830b79e2490d4 · Patch
• https://cve.org/CVERecord?id=CVE-2026-35541 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35541 · Security Note
• https://ubuntu.com/security/CVE-2026-35541 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-46pv-mj2g-93gh · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35541 · Vendor Advisory
• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35541 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35541 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06303 · Security Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 · Note
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 · Note