EUVD-2026-107999

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcubeuser::query matched the address against identity records without qualifying the lookup by IMAP host, so a log...

CVE-2026-114732

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to an improper authentication flaw in multi-host installations. The root cause is that the rcube_user::query() function fails to qualify identity record lookups by IMAP host when a user logs in with an alias address . ...