CVE-2026-114718
Description
A flaw was found in roundcubemail. The password plugin does not properly sanitize error messages returned by password drivers before displaying them in the web interface. A remote attacker or backend service capable of controlling these error responses can execute arbitrary script code in the context of the user's browser session through Cross-Site Scripting (XSS).
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires an uncommon prerequisite where a backend authentication driver is manipulated to return arbitrary HTML content, which is then rendered in the victim's browser session. Roundcube Webmail is not included in Red Hat Enterprise Linux core offerings and is only available through community repositories such as EPEL. Furthermore, the issue only affects deployments where the optional password management plugin is actively enabled and configured against an untrusted driver.
Mitigation
Disable the optional password plugin in Roundcube Webmail.
1. Edit the Roundcube configuration file (typically `/etc/roundcubemail/config.inc.php` or `config/config.inc.php` in the application directory) and remove `'password'` from the `$config['plugins']` array:
php
$config['plugins'] = array(
// remove 'password' from this list
);
2. If bytecode caching such as OPcache is enabled, reload the web service:
`systemctl reload php-fpm`
or
`systemctl reload httpd`
Caveat:
Disabling this plugin prevents users from modifying their passwords directly through the webmail interface.
Warning: Reloading or restarting the `httpd` or `php-fpm` service may temporarily interrupt active connections.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
