Is CVE-2026-114732 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114732 being exploited in the wild.

How severe is CVE-2026-114732?

Medium severity, with a CVSS score of 6.8, published 22 October 2026.

Which products and versions are affected?

Roundcube Webmail before 1.6.20; 1.7.x before 1.7.5.

Is there a fix for CVE-2026-114732?

Yes: fixed in 1.6.20, 1.7.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114732 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114732?

Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114732: Roundcube Webmail improper authentication in multi-host installations

CVE-2026-114732 · Severity: medium · CVSS 6.8 · Published 2026-10-22

Roundcube Webmail is an email client that runs in web browsers and connects to IMAP mail servers. In multi-host setups where one instance serves multiple IMAP servers, an attacker can log in using an alias email address associated with a user on one server and gain access to the account of a different user on another server. This allows unauthorized access to another user's email.

Technologies: Roundcube Webmail. Vendors: Roundcube.

Quick answers

Is CVE-2026-114732 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114732 being exploited in the wild.
How severe is CVE-2026-114732?: Medium severity, with a CVSS score of 6.8, published 22 October 2026.
Which products and versions are affected?: Roundcube Webmail before 1.6.20; 1.7.x before 1.7.5.
Is there a fix for CVE-2026-114732?: Yes: fixed in 1.6.20, 1.7.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114732 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114732?: Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.6.20, 1.7.5

Technical details

The rcube_user::query() function performs alias lookups against identity records without verifying the IMAP host, causing cross-host account confusion in multi-host Roundcube installations. An attacker can exploit this by logging in with an alias email address belonging to a user on a different IMAP host to hijack that user's account. A fix is available in versions 1.6.20 and 1.7.5.

Affected products

Roundcube Webmail before 1.6.20; 1.7.x before 1.7.5

Timeline

2026-10-22: disclosed
2026-10-19: patched: Version 1.6.20 and 1.7.5 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.