CVE-2026-114721: CWE-863 Incorrect Authorization in Roundcube Webmail
Description
CVE-2026-114721 is an authorization bypass vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The issue allows a remote authenticated attacker to bypass the disabled_actions configuration by using deprecated action aliases, enabling access to actions that should be disabled. The vulnerability was fixed by moving the check into the action handler and resolving aliases before comparison.
CVSS v3.1
Score 3.1low
Affected software
Roundcube
Webmail
pkg:github/WebmailRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Roundcube Webmail versions >=1.6.0 <1.6.20 and >=1.7.0 <1.7.5 contain an incorrect authorization vulnerability (CWE-863) where the disabled_actions configuration setting can be bypassed. The original check only compared the requested action name directly, ignoring deprecated aliases. This allowed a remote authenticated attacker to invoke disabled actions by requesting them through their deprecated aliases. The upstream fix involved updating the action handler to resolve aliases before checking against disabled_actions, preventing this bypass.
Potential Impact
The vulnerability allows a remote authenticated attacker with low privileges to bypass restrictions on disabled actions, potentially enabling limited unauthorized actions. The CVSS score is low (3.1) with low impact on integrity and no impact on confidentiality or availability.
Mitigation Recommendations
Upgrade Roundcube Webmail to version 1.6.20 or later in the 1.6.x branch, or to version 1.7.5 or later in the 1.7.x branch, where the issue has been fixed. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-10-22T01:36:10.275Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad96eff4d27ba8daa1d22fe
Added to database: 10/22/2026, 02:03:43 UTC
Last enriched: 10/22/2026, 02:15:50 UTC
Last updated: 10/22/2026, 02:18:51 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.