CVE-2026-114730: CWE-918 Server-Side Request Forgery (SSRF) in Roundcube Webmail

CVE-2026-114730 is a server-side request forgery vulnerability in Roundcube Webmail affecting versions >=1.6.14 <1.6.20 and >=1.7.0 <1.7.5. The vulnerability arises because the network blocklist used by the function rcube_utils::is_local_url() did not include the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48, and the unspecified IPv6 address ::/128. As a result, URLs such as http://[64:ff9b::7f00:1]/ could bypass the SSRF filter and reach internal network addresses including loopback, link-local, and cloud metadata endpoints. The upstream fix involved updating the is_local_url() filter to properly block these address ranges, mitigating the SSRF filter bypass.

An attacker can craft URLs that bypass the SSRF filter and cause the Roundcube Webmail server to make unauthorized requests to internal network resources such as loopback interfaces, link-local addresses, and cloud metadata services. This can lead to information disclosure and potentially further compromise depending on the internal services accessible via these addresses. The CVSS score of 7.2 (high) reflects the network attack vector, low complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

A fix is available upstream that updates the SSRF filter (rcube_utils::is_local_url()) to block the missing NAT64 prefixes and the unspecified address. Users should upgrade Roundcube Webmail to versions 1.6.20 or later, or 1.7.5 or later, where this vulnerability is patched. No additional mitigations are specified by the vendor advisory.