UBUNTU-CVE-2026-107145: Medium severity ubuntu/roundcube vulnerability

Published Oct 27, 2026

Updated

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889.

Affected Software

7 affected components

ubuntu/roundcube*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Roundcube twofactor_gauthenticator plugin to a version that resolves this vulnerability.
Patch 4640889

Event History

Oct 27, 2026

CVE Published

via OSV·10:16 AM

Data Sourced

via OSV·10:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Roundcube deployments using the twofactor_gauthenticator plugin are exposed. An attacker must first obtain a user's password before they can attempt to bypass the second factor.

What does an attacker need to exploit it?

The attacker needs a valid user's password and network access to submit repeated second-factor authentication attempts. No additional privileges or user interaction are required, but the attack depends on brute-forcing a 6-digit code.

Are affected systems vulnerable by default?

The provided information identifies the twofactor_gauthenticator plugin as affected, but does not state whether that plugin is enabled by default in Ubuntu Roundcube installations.

How can this be remediated?

Update to a version of the plugin that includes commit 4640889, which fixes the missing rate limiting issue. The provided information does not identify a specific package version containing the fix.

What can be done while patching is delayed?

The provided information does not specify a temporary mitigation. Because exploitation relies on a compromised password, protecting user passwords is particularly important until the rate-limiting fix is deployed.

UBUNTU-CVE-2026-107145: Medium severity ubuntu/roundcube vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are affected systems vulnerable by default?

How can this be remediated?

What can be done while patching is delayed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are affected systems vulnerable by default?

How can this be remediated?

What can be done while patching is delayed?