Critical Vulnerability in Roundcube: CVE-2026-35537
Summary
DEBIAN-CVE-2026-35537: ... Affects roundcube versions 1.6.1+dfsg-1 – 1.6.9+dfsg-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundcube is a widely used web-based email client that provides a user-friendly interface for managing emails. It supports various features such as address book management, folder manipulation, and email composition. However, it is susceptible to vulnerabilities that can compromise user data and system integrity, making it essential for users to stay updated with the latest security patches.
Vulnerability Detail
CVE-2026-35537 is a vulnerability affecting Roundcube that originates from improper handling of certain input data. This flaw can lead to potential information leakage, allowing unauthorized access to sensitive data. The vulnerability has a CVSS score of 3.7, indicating a moderate level of risk. Attackers could exploit this vulnerability to gain insights into user activities or access restricted information, thereby compromising the security of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can restrict access to the Roundcube application by implementing firewall rules or limiting access to trusted IP addresses until the update is applied. This can be done by configuring the web server settings to allow access only from specific IP ranges.
Conclusion
CVE-2026-35537 poses a moderate risk to Roundcube users, highlighting the importance of timely updates to maintain security. Users are encouraged to apply the recommended updates and consider temporary workarounds to mitigate risks until the updates can be implemented.
See every vulnerability recorded for roundcube →
FAQ
CVE-2026-35537 is a vulnerability in Roundcube that can lead to information leakage and unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2026-35537 is 3.7, indicating a moderate level of risk.
You can update Roundcube by running the command 'sudo apt-get update && sudo apt-get install roundcube' in your terminal.
If you cannot update immediately, consider implementing firewall rules to restrict access to the Roundcube application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for roundcube.
