CVE-2026-114732 is an authentication bypass vulnerability in Roundcube Webmail affecting versions 1.6.0 through before 1.6.20 and 1.7.0 through before 1.7.5. The flaw occurs in multi-host installations where logging in with an alias address could authenticate a user to a different IMAP host's account due to improper qualification of the alias lookup by IMAP host. This issue was fixed upstream by qualifying alias logins by IMAP host.
Roundcube Webmail versions before 1.6.20 and 1.7.5 are vulnerable to an uncontrolled resource consumption issue in the CSS proxy feature. This vulnerability allows an attacker to cause excessive memory usage by referencing a stylesheet URL from an attacker-controlled host, which is read into memory without size limits or timeouts. The issue was fixed by adding a 5 MB size limit, streaming reads, and applying a read timeout to the CSS proxy content processing.
Roundcube Webmail versions 1.6.14 through 1.6.19 and 1.7.0 through 1.7.4 contain a server-side request forgery (SSRF) vulnerability due to an incomplete network blocklist in the is_local_url() filter. This allowed bypass via certain NAT64 prefixes and the unspecified address, enabling crafted URLs to access internal loopback, link-local, and cloud metadata addresses. The issue was fixed upstream by updating the filter to include these missing address ranges.
CVE-2026-114729 is a vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 that allows remote content blocking to be bypassed. The issue arises because the remote content blocker did not inspect the SVG SMIL animation attribute 'by', allowing remote content to load without user consent. This can disclose the client IP address and confirm that a message was opened. The vendor has fixed this issue in a commit addressing the bypass via the 'by' attribute.
CVE-2026-114728 is a medium severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It involves a remote content blocking bypass due to incomplete handling of CSS escape sequences in FuncIRI attributes. This flaw allows remote content to be loaded from HTML messages without user consent. The issue was fixed by normalizing CSS escapes before matching and expanding attribute inspection.
CVE-2026-114727 is a high-severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. The issue involves unsafe handling of SVG and EPS image formats during contact photo uploads, where these formats are passed to ImageMagick for resizing. Since SVG and EPS can reference external resources and invoke ImageMagick delegates, this can lead to inclusion of functionality from an untrusted control sphere. The vulnerability is fixed by removing SVG and EPS from accepted image types.
Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5, contain a mail header injection vulnerability in the Bounce (resend) action. This occurs because the function rcube_mime::decode_address_list() did not remove control characters from the decoded display name, allowing CRLF sequences in the From display-name to inject arbitrary headers when a user bounces a message. This vulnerability has been fixed in versions 1.6.20 and 1.7.5.
Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5, contain a mail header injection vulnerability. This occurs because the function rcmail_sendmail only sanitized newline characters in the Subject and Organization headers, leaving other headers such as References, In-Reply-To, Message-ID, and From vulnerable to injection. A remote authenticated attacker could exploit this to inject arbitrary headers into outgoing emails. The issue was fixed by normalizing whitespace in all string header values in a later commit.
CVE-2026-114724 is a high-severity vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. It involves an object injection primitive caused by improper handling of session keys prefixed with “!” in the rcube_session::unserialize() function. This flaw allows an attacker who can influence stored session data to inject PHP objects, potentially leading to full compromise of confidentiality, integrity, and availability.
CVE-2026-114723 is a low-severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It allows bypassing of ImageMagick resource limits during thumbnail generation when the system falls back to using GD for image processing on non-Windows platforms. This can lead to server memory exhaustion due to lack of resource limits on crafted large images. The issue was fixed by applying memory checks uniformly across all platforms.
CVE-2026-114722 is a vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It involves a CSS scoping bypass in HTML messages where certain CSS at-rules and selectors were not properly scoped to the message body. This flaw allows malicious HTML emails to restyle parts of the Roundcube interface outside the message area, enabling UI redressing and spoofing attacks.
CVE-2026-114721 is an authorization bypass vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The issue allows a remote authenticated attacker to bypass the disabled_actions configuration by using deprecated action aliases, enabling access to actions that should be disabled. The vulnerability was fixed by moving the check into the action handler and resolving aliases before comparison.
CVE-2026-114720 is a vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. It allows a remote authenticated attacker to inject CRLF sequences into the _flag parameter of the mail/mark action, enabling execution of arbitrary IMAP commands. The issue is due to improper neutralization of CRLF sequences (CWE-93).
CVE-2026-114719 is a Cross-Site Request Forgery (CSRF) vulnerability in Roundcube Webmail affecting versions 1.6.0 through before 1.6.20 and 1.7.0 through before 1.7.5. The issue occurs in the mark-as-junk action of the markasjunk plugin, where the _uid parameter is improperly handled, allowing the action to be executed without a valid CSRF token. This vulnerability has a low severity score and no known exploits in the wild.
CVE-2026-114718 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The issue arises in the password plugin where error messages from a password driver are displayed without proper HTML escaping, allowing script injection if the backend can influence the error text. This vulnerability was fixed by escaping the driver message before display.
CVE-2026-114717 is a mail header injection vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The flaw occurs when forwarding a message as an attachment, where the subject line is used directly to name the attachment. If the subject contains CRLF sequences, it can inject arbitrary MIME headers into the outgoing message. This issue has been fixed by collapsing whitespace in the generated attachment name.
CVE-2026-114716 is a mail header injection vulnerability in Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The flaw exists in the rcmail_sendmail::extract_inline_images() function, which uses the media type from an inline image data URI without proper validation. This allows a remote authenticated attacker to inject arbitrary MIME part headers into outgoing messages by inserting CRLF sequences in the media type. The issue has been fixed by validating the media type with rcube_mime::is_mimetype_valid().
CVE-2026-114715 is an incorrect authorization vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The flaw exists in the Modoboa driver of the password plugin, where the driver incorrectly uses the first account returned by the Modoboa API instead of verifying the authenticated user's account. This could allow a password change to be applied to a different user account.
CVE-2026-114714 is a path traversal vulnerability in the squirrelmail_usercopy plugin of Roundcube Webmail. Versions before 1.6.20 and 1.7.x before 1.7.5 are affected. The vulnerability arises because the source path for file import is constructed from the login name without filtering out path separators, allowing an attacker to read files outside the intended directory. The issue was fixed by rejecting login names containing slashes.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.