CVE-2026-35538

LOW

Roundcube Webmail < 1.5.14 - CSRF

Title source: rule

Description

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

References (7)

https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14

https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5

https://github.com/roundcube/roundcubemail/commit/5fe8a69956a9683a4269f3ad2a68e18deebf8a15

https://github.com/roundcube/roundcubemail/releases/tag/1.6.14

https://github.com/roundcube/roundcubemail/commit/b18a8fa8e81571914c0ff55d4e20edb459c6952c

https://github.com/roundcube/roundcubemail/releases/tag/1.5.14

https://github.com/roundcube/roundcubemail/commit/7daf5aa9c190ccc75bb31672d8fee9938877fd64

View Patch ZIP pw:eip

Scores

CVSS v3 3.1

EPSS 0.0004

EPSS Percentile 12.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-88

Status published

Products (4)

roundcube/roundcubemail 1.7-beta - 1.7-rc5Packagist

Roundcube/Webmail < 1.5.14

roundcube/webmail < 1.5.14

Roundcube/Webmail 1.6.0 - 1.6.14

Published Apr 03, 2026

Tracked Since Apr 03, 2026