CVE-2026-114724: CWE-502 Deserialization of Untrusted Data in Roundcube Webmail

The vulnerability arises because Roundcube Webmail's session unserialization logic treats session keys starting with “!” as having no value, causing desynchronization of the serialized input. This desynchronization leads to subsequent session data being interpreted as serialized PHP objects, enabling an object injection primitive. This can be exploited by an attacker able to control stored session data. The issue was fixed upstream by rejecting session keys prefixed with “!” in the rcube_session::unserialize() method.

Successful exploitation of this vulnerability can lead to PHP object injection, which may allow an attacker to execute arbitrary code, manipulate application logic, or cause denial of service. The CVSS 3.1 score of 7.4 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local access or the ability to influence stored session data, and the attack complexity is high.

A fix is available and has been implemented upstream by rejecting session keys prefixed with “!” in the rcube_session::unserialize() function. Users should upgrade Roundcube Webmail to version 1.6.20 or later, or 1.7.5 or later, where this vulnerability is resolved. No additional mitigation is required if these versions are deployed.