This vulnerability (CVE-2026-35541) affects Roundcube Webmail prior to versions 1.5.14 and 1.6.14. It is caused by a type confusion flaw (CWE-843) in the password plugin where the password comparison does not correctly verify the old password due to incompatible type handling. This flaw could be exploited to change a user's password without knowledge of the current password, potentially allowing unauthorized account access or takeover. The CVSS v3.1 base score is 4.2, indicating medium severity, with network attack vector, high attack complexity, low privileges required, and no user interaction needed. No official patch or vendor advisory confirming remediation is currently available.

Successful exploitation allows an attacker with low privileges to change a user's password without knowing the original password, potentially leading to unauthorized account access or takeover. The confidentiality and integrity of the affected accounts are impacted at a low level, with no impact on availability reported. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for updates from Roundcube and consider restricting access to the password change functionality or implementing additional authentication controls where possible. Avoid relying solely on the vulnerable password plugin for authentication security.