CVE-2026-114726: CWE-99 Improper Control of Resource Identifiers ('Resource Injection') in Roundcube Webmail

CVE-2026-114726 is a CWE-99 Improper Control of Resource Identifiers ('Resource Injection') vulnerability affecting Roundcube Webmail before versions 1.6.20 and 1.7.5. The flaw exists in the Bounce (resend) action where the function rcube_mime::decode_address_list() fails to strip control characters from the decoded display name in the From header. An attacker can craft a message with CRLF sequences in an encoded word in the From display-name, which leads to injection of arbitrary mail headers into the message emitted during the bounce operation. This vulnerability was addressed upstream by a commit titled “Fix mail header injection via the From display-name in the Bounce (resend) action”.

The vulnerability allows an attacker to inject arbitrary mail headers when a user performs the Bounce (resend) action on a crafted message. This can lead to mail header injection, potentially affecting the integrity of bounced messages. The CVSS score of 5.8 (medium severity) reflects that the impact is limited to integrity with no confidentiality or availability impact. There is no indication of known exploits in the wild.

Upgrade Roundcube Webmail to version 1.6.20 or later in the 1.6.x branch, or to version 1.7.5 or later in the 1.7.x branch, where this vulnerability has been fixed. No other mitigation is indicated or required according to the available data.