Güvenlik açığıOrta

CVE-2026-114715: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect…

CVE-2026-11471522 Ekim 2026Kaynak: NVD

6.8

CVSS

Türkçe çeviri bekliyor; özgün İngilizce özet gösteriliyor

Özgün özet (İngilizce)

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.

Özgün kaynaklar

Bu kayıt özgün kaynaktaki bilgilerden derlendi. Kesin bilgi için özgün kaynağa bakın.

Aynı üründen diğer kayıtlar

Güvenlik açığıCiddiyet belirsizRoundcube23 Ekim 2026
DSA-6579-1 roundcube - security update
https://security-tracker.debian.org/tracker/DSA-6579-1
Güvenlik açığıOrtaRoundcube22 Ekim 2026
CVE-2026-114731: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.
5.3
CVSS
Güvenlik açığıYüksek Düzeltme: 1.6.20Roundcube22 Ekim 2026
CVE-2026-114727: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
8.3
CVSS
Güvenlik açığıDüşük Düzeltme: 1.6.20Roundcube22 Ekim 2026
CVE-2026-114723: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource…
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.
3.7
CVSS

Aynı üründen diğer kayıtlar

Güvenlik açığıCiddiyet belirsizRoundcube23 Ekim 2026

DSA-6579-1 roundcube - security update

https://security-tracker.debian.org/tracker/DSA-6579-1

Güvenlik açığıOrtaRoundcube22 Ekim 2026

CVE-2026-114731: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled…

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.

5.3

CVSS

Güvenlik açığıYüksek Düzeltme: 1.6.20Roundcube22 Ekim 2026

CVE-2026-114727: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content…

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.

8.3

CVSS

Güvenlik açığıDüşük Düzeltme: 1.6.20Roundcube22 Ekim 2026

CVE-2026-114723: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource…

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.

3.7

CVSS