VYPR
Get started
← All advisories
Medium severity4.2NVD Advisory· Published Apr 3, 2026· Updated Apr 7, 2026

CVE-2026-35541

CVE-2026-35541

Description

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
roundcube/roundcubemailPackagist
>= 1.7-beta, < 1.7-rc51.7-rc5

Affected products

1

Patches

3
2e6a99b2a381

Fix bug where a password could get changed without providing the old password

https://github.com/roundcube/roundcubemailAleksander MachniakMar 17, 2026via ghsa
commit
2 files changed · +3 −2
  • CHANGELOG.md+1 −0 modified
    @@ -3,6 +3,7 @@
 ## Unreleased
 
 - Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler
+- Security: Fix bug where a password could get changed without providing the old password
 
 ## Release 1.5.13
  • plugins/password/password.php+2 −2 modified
    @@ -333,10 +333,10 @@ private function _compare($curpwd, $newpwd, $type)
         else {
             switch ($type) {
             case PASSWORD_COMPARE_CURRENT:
-                $result = $curpwd != $newpwd ? $this->gettext('passwordincorrect') : null;
+                $result = $curpwd !== $newpwd ? $this->gettext('passwordincorrect') : null;
                 break;
             case PASSWORD_COMPARE_NEW:
-                $result = $curpwd == $newpwd ? $this->gettext('samepasswd') : null;
+                $result = $curpwd === $newpwd ? $this->gettext('samepasswd') : null;
                 break;
             default:
                 $result = $this->gettext('internalerror');
6fa2bddc59b9

Fix bug where a password could get changed without providing the old password

https://github.com/roundcube/roundcubemailAleksander MachniakMar 17, 2026via ghsa
commit
2 files changed · +3 −2
  • CHANGELOG.md+1 −0 modified
    @@ -4,6 +4,7 @@
 
 - Fix Postgres connection using IPv6 address (#10104)
 - Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler
+- Security: Fix bug where a password could get changed without providing the old password
 
 ## Release 1.6.13
  • plugins/password/password.php+2 −2 modified
    @@ -333,10 +333,10 @@ private function _compare($curpwd, $newpwd, $type)
         else {
             switch ($type) {
             case PASSWORD_COMPARE_CURRENT:
-                $result = $curpwd != $newpwd ? $this->gettext('passwordincorrect') : null;
+                $result = $curpwd !== $newpwd ? $this->gettext('passwordincorrect') : null;
                 break;
             case PASSWORD_COMPARE_NEW:
-                $result = $curpwd == $newpwd ? $this->gettext('samepasswd') : null;
+                $result = $curpwd === $newpwd ? $this->gettext('samepasswd') : null;
                 break;
             default:
                 $result = $this->gettext('internalerror');
6a275676a804

Fix bug where a password could get changed without providing the old password

https://github.com/roundcube/roundcubemailAleksander MachniakMar 17, 2026via ghsa
commit
2 files changed · +3 −2
  • CHANGELOG.md+1 −0 modified
    @@ -10,6 +10,7 @@ This file includes only changes we consider noteworthy for users, admins and plu
 - Fix Postgres connection using IPv6 address (#10104)
 - Fix bug where `rel=stylesheet` part of a `<link>` could get removed
 - Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler
+- Security: Fix bug where a password could get changed without providing the old password
 
 ## 1.7-rc4
  • plugins/password/password.php+2 −2 modified
    @@ -326,10 +326,10 @@ private function _compare($curpwd, $newpwd, $type)
         } else {
             switch ($type) {
                 case PASSWORD_COMPARE_CURRENT:
-                    $result = $curpwd != $newpwd ? $this->gettext('passwordincorrect') : null;
+                    $result = $curpwd !== $newpwd ? $this->gettext('passwordincorrect') : null;
                     break;
                 case PASSWORD_COMPARE_NEW:
-                    $result = $curpwd == $newpwd ? $this->gettext('samepasswd') : null;
+                    $result = $curpwd === $newpwd ? $this->gettext('samepasswd') : null;
                     break;
                 default:
                     $result = $this->gettext('internalerror');

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.