CVE-2026-35541

Katalog CVE

CVSS 4.2 · Medium EPSS 0,31%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada roundcube webmail. Skor CVSS 3.1 4.2 (Medium) menurut mitre.org.

Deskripsi (NVD)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.2 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/2e6a99b2a38110907ea8d3be8e59ec3d5802c394 patch
• https://github.com/roundcube/roundcubemail/commit/6a275676a8043083c05c961914d830b79e2490d4 patch
• https://github.com/roundcube/roundcubemail/commit/6fa2bddc59b9c9fd31cad4a9e2954a208d793dce patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 release notes