VulnerabilityBSI CERT-Bund
Roundcube Webmail: Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein Angreifer kann mehrere Schwachstellen in Roundcube Webmail ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Highbsi:WID-SEC-2026-288010 linked CVEs
Open advisory with all CVEs
More on Roundcube
Other advisories
- HighCVE-2026-75000Roundcube Webmail: Mehrere Schwachstellen
- CriticalCVE-2026-54432Roundcube: Mehrere Schwachstellen
- Highbsi:WID-SEC-2025-1208Roundcube: Schwachstelle ermöglicht Codeausführung
- HighCVE-2026-113386Roundcube Webmail: Mehrere Schwachstellen
- Not ratedosv:openSUSE-SU-2026:22195-1Security update for roundcubemail
- MediumCVE-2026-107147The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation…
- MediumCVE-2026-107146The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session …
- MediumCVE-2026-107145The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who…
Other news entries
- Roundcube: Schwachstelle ermöglicht CodeausführungVulnerabilityBSI CERT-Bund
- Roundcube Webmail: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Roundcube Webmail: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Multiples vulnérabilités dans Roundcube Webmail (19 octobre 2026)NewsCERT-FR (ANSSI)
- Multiples vulnérabilités dans Roundcube Webmail (19 octobre 2026)NewsCERT-FR (ANSSI)
- Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the WildNewsThe Hacker News
- Roundcube Webmail Vulnerability in Attackers’ CrosshairsNewsSecurityWeek
- Hackers now exploit critical Roundcube flaw in code injection attacksNewsBleepingComputer
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2880
ID