Roundcube Webmail prior to versions 1.6.20 and 1.7.x before 1.7.5 contains an authentication flaw in multi‑host setups. When a user logs in with an alias address, the lookup for the corresponding user account does not qualify the search by IMAP host, which allows the login to match an account in another host. This flaw can lead to unauthorized access to a victim user account that belongs to a different mail server, compromising confidentiality and potentially allowing further actions on that host.

Deployments of Roundcube Webmail running any version prior to 1.6.20 or any 1.7.x version before 1.7.5 that are configured with multiple IMAP hosts and alias addresses are affected by this vulnerability. The flaw is only present in multi-host environments where separate IMAP hosts are used for different user groups.

The CVSS score of 6.8 signals a moderate severity. The EPSS score of less than 1% indicates that exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this by submitting a login request with an alias address through the public webmail interface; no prior authentication is required beyond the login attempt, making remote exploitation feasible. The attack requires that the target system is configured for multiple IMAP hosts and allows alias logins, so the impact is limited to misdirected authentication within the same webmail instance.