CVE-2026-75004 affects Roundcube Webmail instances using the managesieve plugin in versions prior to 1.6.18 and 1.7.3. The vulnerability arises from improper quoting of rule names, which can be exploited by crafting a Sieve script rule name to bypass the managesieve_disabled_actions setting. This setting is intended to restrict certain actions, but the bypass could allow unauthorized actions within the plugin's context. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows an attacker with privileges to submit Sieve scripts to bypass the managesieve_disabled_actions setting, potentially enabling unauthorized actions within the managesieve plugin. There is no impact on confidentiality or availability, but integrity is affected to a limited extent. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review managesieve plugin configurations and restrict access to Sieve script submission to trusted users only.