CVE-2026-35541: 
PHP vulnerability analysis and mitigation

CVE-2026-35541 is a type confusion vulnerability in the Roundcube Webmail password plugin that allows an authenticated attacker to change an account's password without knowing the current password. It affects Roundcube Webmail versions before 1.5.14 and versions 1.6.0 through 1.6.13. The vulnerability was disclosed on March 18, 2026, when Roundcube released security updates, and was reported by researcher flydragon777. It carries a CVSS v3.1 base score of 4.2 (Medium) (GitHub Advisory, Roundcube Release).

The root cause is PHP loose comparison (type juggling) in the _compare() method of plugins/password/password.php, classified as CWE-843 (Access of Resource Using Incompatible Type / Type Confusion) and CWE-1024 (Comparison of Incompatible Types). The vulnerable code used != and == operators instead of strict !== and === operators when comparing the current password against the supplied value, enabling PHP's type coercion to evaluate certain inputs as equal regardless of their actual string values. An attacker must already be authenticated (low-privilege) and the password plugin must be enabled; the attack complexity is rated High, reflecting that specific type-juggling conditions must be met. The fix, applied in commits 6a27567 and 6fa2bdd, replaces loose comparisons with strict identity operators (Roundcube Commit 1.6.x, Roundcube Commit 1.5.x).

A low-privileged authenticated user can bypass the old-password verification step and set a new password for their own account without knowing the current credential. This primarily affects integrity and, to a lesser extent, confidentiality — an attacker who has temporary or partial access to an account (e.g., via session hijacking or a shared device) could lock out the legitimate owner by changing the password. The availability impact is none, and lateral movement potential is limited to the scope of the compromised email account (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of writing. The EPSS score is approximately 0.034%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated session and specific type-juggling conditions, which raises the practical bar for abuse (GitHub Advisory, Feedly).

1. Authenticate: Log in to a vulnerable Roundcube Webmail instance (before 1.5.14 or 1.6.0–1.6.13) with any valid user credentials.
2. Navigate to password change: Access the password change form provided by the Roundcube password plugin (typically under Settings → Password).
3. Craft a type-juggling payload: Supply a value for the "current password" field that, due to PHP loose comparison (==), evaluates as equal to the stored password hash or the expected value under PHP type coercion (e.g., a numeric string 0 or true-like value that PHP coerces to match).
4. Submit the request: Send the password change request with the crafted current-password value and a chosen new password.
5. Bypass validation: The vulnerable _compare() function evaluates the loose comparison as true, skipping the "password incorrect" error and accepting the new password.
6. Account takeover: The account password is now changed to the attacker's chosen value, locking out the legitimate owner (Roundcube Commit 1.6.x, GitHub Advisory).

• Logs: Roundcube application logs showing a successful password change event for a user account without a preceding failed authentication attempt or without the expected "passwordincorrect" error entry.
• Logs: Web server access logs recording POST requests to the Roundcube password plugin endpoint (e.g., /?_task=settings&_action=plugin.password-save) with unusual or non-standard values in the _curpasswd parameter (e.g., numeric strings, empty values, or 0).
• Application Events: Multiple rapid password change attempts from the same authenticated session or IP address, particularly if the old password field contains atypical values.
• Account Activity: User account lockouts or login failures reported by legitimate users shortly after a password change event they did not initiate.

Roundcube has released patched versions addressing this vulnerability: 1.5.14 (for 1.5.x branch), 1.6.14 (for 1.6.x branch), and 1.7-rc5 (for the upcoming 1.7 branch). All productive installations should be upgraded immediately; backups should be taken before updating. As a temporary workaround if immediate patching is not possible, administrators can disable the password plugin or restrict access to the password change functionality until the upgrade is applied. Post-patching, reviewing password change logs for unauthorized modifications is also recommended (Roundcube 1.6.14 Release, Roundcube 1.5.14 Release, Roundcube Security Update).

The vulnerability was reported to Roundcube by researcher flydragon777 and was addressed as part of a broader March 2026 security release that fixed eight issues simultaneously. Red Hat tracked the issue via Bugzilla and assessed it for impact on their products. Coverage appeared on Linux security news aggregators and German-language security outlets (pro-linux.de), and Debian and Fedora downstream advisories were subsequently issued. No significant social media controversy or high-profile researcher commentary beyond standard disclosure channels has been observed (Red Hat Bugzilla, Roundcube 1.6.14 Release).