CVE-2026-114732 Roundcube CVE debrief

Who should care

Defenders managing Roundcube Webmail installations, especially those with multi-host configurations, should assess exposure and apply necessary patches or mitigations. This includes verifying Roundcube Webmail version and configurations, reviewing multi-host installation configurations for potential exposure, and monitoring user login activity for anomalies. Security teams and vulnerability management teams should prioritize verifying exposure in multi-

Why it matters

CVE-2026-114732 is a MEDIUM-severity vulnerability in Roundcube Webmail that could allow unauthorized access in multi-host installations. Defenders should verify exposure, especially in multi-host environments, and apply patches or mitigations as necessary.

• Potential unauthorized access to user accounts across different IMAP hosts.
• Possible lateral movement within multi-host environments.
• Need for verification of current version and exposure in multi-host installations.
• Priority on applying patches or mitigations to prevent exploitation.

Technical summary

The vulnerability exists in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5. It allows a user logging in with an alias address in a multi-host installation to potentially match against identity records without being qualified by IMAP host. This could allow a login to resolve to a user account on a different IMAP host. The vulnerability was fixed in commits addressing the issue directly. Defenders managing Roundcube Webmail installations, especially those with multi-host configurations, should assess exposure and apply necessary patches or mitigations.

Defensive priority

Defenders should prioritize verifying exposure in multi-host Roundcube Webmail installations and apply patches or mitigations as available.

Recommended defensive actions

• Verify Roundcube Webmail version and apply patches for 1.6.20 or 1.7.5 as necessary.
• Review multi-host installation configurations for potential exposure.
• Monitor user login activity for anomalies.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, specific details on exploitation or victim impact are not provided. Defenders should verify Roundcube Webmail version and configurations, review multi-host installation configurations for potential exposure, and monitor user login activity for anomalies. Evidence is limited, so defenders must be cautious and verify information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.