{"action":"Upgrade roundcube/roundcubemail to 1.7-rc5 or later.","affected":[{"fixed":"1.7-rc5","introduced":"1.7-beta"}],"component":"roundcube/roundcubemail","cve_ids":["CVE-2026-35541"],"ecosystem":"Packagist","epss":0.00243,"exploited":false,"fixed_versions":["1.7-rc5"],"ghsa_id":"GHSA-46pv-mj2g-93gh","id":"tcs_01M5KETQD3PC0M3ZKG6529N26V","modified_at":"2026-04-04T07:11:22.681264Z","published_at":"2026-04-03T06:31:32Z","references":["https://osv.dev/vulnerability/GHSA-46pv-mj2g-93gh","https://nvd.nist.gov/vuln/detail/CVE-2026-35541","https://github.com/roundcube/roundcubemail/commit/2e6a99b2a38110907ea8d3be8e59ec3d5802c394","https://github.com/roundcube/roundcubemail/commit/6a275676a8043083c05c961914d830b79e2490d4","https://github.com/roundcube/roundcubemail/commit/6fa2bddc59b9c9fd31cad4a9e2954a208d793dce","https://github.com/roundcube/roundcubemail","https://github.com/roundcube/roundcubemail/releases/tag/1.5.14","https://github.com/roundcube/roundcubemail/releases/tag/1.6.14","https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5","https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-46pv-mj2g-93gh","url":"https://osv.dev/vulnerability/GHSA-46pv-mj2g-93gh"}],"summary":"Roundcube Webmail: Incorrect password comparison in the password plugin"}