A mail header injection vulnerability exists in Roundcube via the From display-name in the Bounce (resend) action. This flaw allows an attacker to inject malicious content into email headers when resending bounced emails. The vulnerability affects multiple specific versions of Roundcube. The CVSS score is 5.8, indicating a medium severity impact primarily on email integrity.
A mail header injection vulnerability exists in Roundcube affecting specific versions. The flaw involves injection via the References, In-Reply-To, Message-ID, and From email header parameters. This vulnerability has a medium severity rating with a CVSS score of 5.0. No known exploits in the wild have been reported. The affected versions are explicitly listed and include multiple specific package versions.
A high-severity vulnerability (CVE-2026-114724) in Roundcube affects multiple specific versions. The flaw involves an object injection primitive in the rcube_session::unserialize() function via session keys prefixed with an exclamation mark (!). This vulnerability can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 7.4, indicating high impact. No public exploits or known exploitation in the wild have been reported. The affected versions are explicitly listed, and the product is not a cloud service.
A vulnerability in ImageMagick allows resource limits to be bypassed via the GD fallback mechanism during thumbnail generation. This flaw affects specific Ubuntu package versions of ImageMagick 6.7.7.10. The issue has a low severity with a CVSS score of 3.7, indicating limited impact primarily on availability. No known exploits are reported in the wild.
A medium severity vulnerability (CVE-2026-114722) in Roundcube allows a CSS scoping bypass in HTML messages using at-rules. This flaw could enable limited unauthorized information disclosure or modification via crafted HTML content. The issue affects multiple specific Roundcube versions. No known exploits are reported in the wild.
CVE-2026-114732 is an authentication bypass vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw occurs in multi-host setups where logging in with an alias address could incorrectly authenticate a user to an account on a different IMAP host due to improper qualification of the alias lookup. This issue was fixed by qualifying alias logins by IMAP host in the code.
A high-severity vulnerability (CVE-2026-114720) in Roundcube allows IMAP command injection via CRLF characters in the _flag parameter of the mail/mark action. This flaw can lead to unauthorized modification of mail flags, impacting the integrity of mail data. The vulnerability affects multiple specific versions of Roundcube as listed. The CVSS score is 7.1, indicating a high impact on confidentiality and integrity but no impact on availability.
A Cross-Site Request Forgery (CSRF) validation bypass vulnerability exists in the mark-as-junk action of Roundcube. This flaw allows an attacker to perform unauthorized mark-as-junk actions without proper CSRF validation. The vulnerability has a low severity score and affects multiple specific versions of Roundcube.
A mail header injection vulnerability exists in Roundcube when forwarding a message as an attachment, specifically via the subject field. This flaw allows an attacker to inject malicious content into mail headers. The vulnerability has a medium severity rating with a CVSS score of 4.0. Multiple specific versions of Roundcube are affected. No public exploits or known active exploitation have been reported. The vulnerability has been publicly disclosed as of October 23, 2026.
A high-severity vulnerability (CVE-2026-114716) in Roundcube allows mail header injection via the media type in an inline image data URI. This flaw affects multiple specific versions of Roundcube and can lead to partial confidentiality loss and high integrity impact without availability impact. The vulnerability was published on October 23, 2026, and has a CVSS score of 8.5.
A vulnerability in Roundcube's Password Modoboa driver allows an attacker with limited privileges to change the password of another account. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 6.8. The vulnerability does not have known exploits in the wild and is not a cloud service.
CVE-2026-114730 is a server-side request forgery (SSRF) vulnerability in Roundcube Webmail versions 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5. The vulnerability arises because the network blocklist used by the is_local_url() function did not include certain NAT64 prefixes and the unspecified address, allowing crafted URLs to bypass the filter and access internal network addresses. This flaw was fixed in versions 1.6.20 and 1.7.5.
CVE-2026-114729 is a vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.5 that allows bypassing the remote content blocker via the SVG SMIL 'by' attribute. This flaw causes remote content to be loaded without user consent, potentially disclosing the client IP address and confirming message opening.
CVE-2026-114728 is a vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5 that allows remote content blocking to be bypassed due to incomplete handling of CSS escape sequences in FuncIRI attributes. This flaw enables loading remote content from HTML messages without user consent. The issue was fixed by normalizing CSS escapes and inspecting additional attributes to block remote content properly.
CVE-2026-114727 is a high-severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. The issue involves unsafe handling of SVG and EPS image formats during contact photo uploads, where these formats are passed to ImageMagick for resizing. Since SVG and EPS can reference external resources and invoke ImageMagick delegates, this can lead to inclusion of functionality from an untrusted control sphere. The vulnerability is fixed by removing SVG and EPS from accepted image types.
CVE-2026-114721 is an authorization bypass vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The issue arises because the disabled_actions configuration setting could be bypassed by using deprecated action aliases, allowing a remote authenticated attacker to access actions that should be disabled. This flaw was fixed by moving the check into the action handler and resolving aliases before comparison.
CVE-2026-114718 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw occurs in the password plugin where error messages from a password driver are displayed without proper HTML escaping. This allows a backend capable of influencing the error text, such as the DirectAdmin API, to inject malicious scripts into the Roundcube interface. The issue was fixed by escaping the driver message before display in versions 1.6.20 and 1.7.5.