CVE-2022-28218: Ciphermail Webmail Messenger

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4. A local attacker could access secret keys (found in a Roundcube configuration file) that are used to protect Webmail user passwords and two-factor authentication (2FA).

Affected products

• Ciphermail Webmail Messenger: from 1.1.1, before 4.2.1 (fixed in 4.2.1)

Published 2022-04-26. Last modified 2026-06-17.