Threats affecting pkg:composer/Webmail

CVE-2026-126813 is a vulnerability in Roundcube Webmail versions before 1.6.21 and 1.7.x before 1.7.6. It allows attackers to inject IMAP commands via CRLF sequences in the _uid parameter when the messages_cache feature is enabled. This can lead to unauthorized deletion of messages, modification of message flags, or granting mailbox access through the SETACL command. The vulnerability requires a logged-in victim to open a crafted GET link. It has a high severity with a CVSS 4.0 score of 7.4.

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).