{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114718", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-22T01:24:46.603Z", "datePublished": "2026-10-22T01:24:46.941Z", "dateUpdated": "2026-10-22T01:24:46.941Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit \u201cFix XSS issue in handling of password driver error responses\u201d, which escapes the driver message before display."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-22T01:24:46.941Z"}, "references": [{"tags": ["issue-tracking", "third-party-advisory"], "url": "https://bugs.debian.org/1151279"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/16bbca70b668e85332f23333946a764865bead94"}, {"tags": ["vendor-advisory", "release-notes"], "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.6.0", "versionEndExcluding": "1.6.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.0", "versionEndExcluding": "1.7.5"}]}]}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit \u201cFix XSS issue in handling of password driver error responses\u201d, which escapes the driver message before display."}], "id": "CVE-2026-114718", "lastModified": "2026-10-22T02:16:59.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.7, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-10-22T02:16:59.410", "references": [{"source": "cve@mitre.org", "url": "https://bugs.debian.org/1151279"}, {"source": "cve@mitre.org", "url": "https://github.com/roundcube/roundcubemail/commit/16bbca70b668e85332f23333946a764865bead94"}, {"source": "cve@mitre.org", "url": "https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7"}, {"source": "cve@mitre.org", "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"source": "cve@mitre.org", "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"source": "cve@mitre.org", "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve@mitre.org", "type": "Primary"}]}

{"bugzilla": {"description": "roundcubemail: roundcubemail: Cross-site scripting via unescaped password driver error messages", "id": "2558698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558698"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in roundcubemail. The password plugin does not properly sanitize error messages returned by password drivers before displaying them in the web interface. A remote attacker or backend service capable of controlling these error responses can execute arbitrary script code in the context of the user's browser session through Cross-Site Scripting (XSS)."], "mitigation": {"lang": "en:us", "value": "Disable the optional password plugin in Roundcube Webmail.\n1. Edit the Roundcube configuration file (typically `/etc/roundcubemail/config.inc.php` or `config/config.inc.php` in the application directory) and remove `'password'` from the `$config['plugins']` array:\n```php\n$config['plugins'] = array(\n// remove 'password' from this list\n);\n```\n2. If bytecode caching such as OPcache is enabled, reload the web service:\n`systemctl reload php-fpm`\nor\n`systemctl reload httpd`\nCaveat:\nDisabling this plugin prevents users from modifying their passwords directly through the webmail interface.\nWarning: Reloading or restarting the `httpd` or `php-fpm` service may temporarily interrupt active connections."}, "name": "CVE-2026-114718", "public_date": "2026-10-22T01:24:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114718\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114718\nhttps://bugs.debian.org/1151279\nhttps://github.com/roundcube/roundcubemail/commit/16bbca70b668e85332f23333946a764865bead94\nhttps://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.20\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.5\nhttps://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires an uncommon prerequisite where a backend authentication driver is manipulated to return arbitrary HTML content, which is then rendered in the victim's browser session. Roundcube Webmail is not included in Red Hat Enterprise Linux core offerings and is only available through community repositories such as EPEL. Furthermore, the issue only affects deployments where the optional password management plugin is actively enabled and configured against an untrusted driver.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.0,1.6.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.0,1.7.5)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Webmail", "source": "cna", "vendor": "Roundcube"}, "product": "webmail", "vendor": "roundcube"}], "created": "2026-10-22T05:30:08.011377+00:00", "title": "Cross\u2011Site Scripting via Unescaped Password Driver Error in Roundcube Webmail", "updated": "2026-10-22T06:30:17.853312+00:00", "vendors": ["roundcube", "roundcube$PRODUCT$webmail"]}