Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 6.8 | CVE-2026-114732 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations
RoundcubeRoundcube Webmail
|
NVD | |||
|
CVE-2026-114732Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by an improper authentication flaw that occurs in multi-host installations. The advisory does not state a severity rating or score. Upgrading to 1.6.20 or 1.7.5 is the fix the advisory points to. Technical summaryThe advisory classifies the issue as improper authentication affecting multi-host Roundcube installations. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5. The advisory does not state an attack vector, required privileges, or whether exploitation has been observed. A Debian bug thread quoted in the advisory lists a fix titled 'alias login wasn't qualified by IMAP host' and ties this CVE to that item, but the advisory text itself does not describe the mechanism. No workaround, detection guidance, or CVSS score is stated. The Debian package fixed version is given as roundcube/1.6.20+dfsg-1. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114731 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114731Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain an uncontrolled resource consumption flaw in the CSS proxy (the utils/modcss action). The advisory does not state a severity rating for this specific CVE, though the Debian bug report that tracks the batch of fixes is marked important. The fix is to upgrade to Roundcube 1.6.20 or 1.7.5, which the advisory indicates are the fixed releases. Technical summaryThe flaw is classed as uncontrolled resource consumption in the CSS proxy utils/modcss action of Roundcube Webmail. The advisory states the fix is a size limit added to the CSS proxy content processing, in upstream 1.6.20 and 1.7.5. Attack vector and preconditions are not stated in this advisory. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5. Debian package versions referenced include roundcube/1.6.19+dfsg-1, roundcube/1.6.19+dfsg-0+deb13u1 and roundcube/1.6.5+dfsg-1+deb12u12 as found versions, with roundcube/1.6.20+dfsg-1 as the fixed Debian version. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.2 | CVE-2026-114730 |
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114730Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass
Executive summaryRoundcube Webmail versions 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 are affected by a server-side request forgery filter bypass, and the advisory is tied to a larger batch of fixes in the 1.6.20 and 1.7.5 releases. The advisory does not state a severity rating for this CVE. The fix is to upgrade to Roundcube 1.6.20 or 1.7.5 or later, as the upstream and Debian updates indicate. Technical summaryThe flaw is a server-side request forgery (SSRF) filter bypass in the is_local_url() check, which the advisory says can be bypassed via the NAT64 64:ff9b::/96 prefix. The advisory does not state the attack vector details, required privileges, or user interaction beyond this description. Affected versions are stated as 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5, and the fixed versions are 1.6.20 and 1.7.5 as written. Debian's bug report lists found versions 1.6.5+dfsg-1+deb12u12, 1.6.19+dfsg-1 and 1.6.19+dfsg-0+deb13u1, and fixed version 1.6.20+dfsg-1. No CVSS score, workaround, or exploitation status is stated, and no detection guidance is given for this specific CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114729 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114729Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a remote content blocking bypass, as well as a set of other security fixes released together in the same update. The advisory does not state a severity rating for this specific CVE, and the Debian bug report lists the overall batch as important. The recommended action is to upgrade to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a remote content blocking bypass in Roundcube, reported as a bypass via SVG SMIL by attribute, which lets remote content get past the blocker in HTML messages. The advisory does not describe the attack vector in detail beyond this, and preconditions are not stated. Fixed versions are given as 1.6.20 and, per the title, 1.7.5 for the 1.7.x branch; the Debian package fix is 1.6.20+dfsg-1. Affected Debian versions listed are 1.6.5+dfsg-1+deb12u12, 1.6.19+dfsg-1 and 1.6.19+dfsg-0+deb13u1. No workaround, CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114728 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114728Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw that lets remote content bypass blocking, which is a privacy concern for webmail users. The advisory does not state a severity score, and the Debian bug report lists its severity as important. The vendor's fix is to upgrade to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a remote content blocking bypass in the handling of FuncIRI attributes, caused by CSS escapes, and the advisory describes it as a repeat fix. The advisory does not state the attack vector details, required user interaction, or privileges. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and fixed versions are 1.6.20 and 1.7.5. Debian's package versions listed were 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1, and 1.6.5+dfsg-1+deb12u12, with fix 1.6.20+dfsg-1. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.3 | CVE-2026-114727 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images
Debian, ImageMagick, RoundcubeImageMagick, Roundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw where potentially unsafe attachment content is passed into ImageMagick when images are resized. The advisory does not state a severity rating for this specific issue, but the Debian bug report that tracks the batch of fixes is marked important. The fix is to update Roundcube to 1.6.20 or 1.7.5 or later, as the upstream release notes recommend. Technical summaryThe flaw is described as passing potentially unsafe content into ImageMagick during image resizing, which is an unsafe handling of attachment data. The advisory does not state the attack vector, required privileges or user interaction, or a CVSS score. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and the fixed versions are 1.6.20 and 1.7.5 per the advisory text. Debian's tracker lists fixed package version 1.6.20+dfsg-1 and found versions 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12. No workaround is stated, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityLow
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L AffectsDebianImageMagickRoundcubeImageMagickRoundcube WebmailDebian roundcube
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.8 | CVE-2026-114726 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a mail header injection flaw in the Bounce (resend) action, which is one of a batch of security fixes released together. The advisory does not state a severity score for this specific CVE, though the Debian bug report is marked important. The recommended remedy is to update to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a mail header injection in the Bounce (resend) action of Roundcube Webmail, fixed via a change to the From display-name handling. The advisory names affected versions as before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1. Attack vector, required privileges, and user interaction are not stated. No workaround is stated, and no CVSS score or exploitation status is stated. Detection guidance is not stated. The advisory notes that the CVE ID for this issue is CVE-2026-114726, assigned as the Bounce action header injection item in a batch fix list. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.0 | CVE-2026-114725 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
RoundcubeRoundcube Webmail
|
NVD | |||
|
CVE-2026-114725Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a mail header injection vulnerability, which is tied to CVE-2026-114725 in the linked Debian bug report. The advisory does not state a severity rating or a CVSS score. The fix is to update Roundcube to 1.6.20 or 1.7.5, the versions the advisory identifies as fixed. Technical summaryThe vulnerability class is mail header injection. The Debian bug report associates CVE-2026-114725 with header injection through the References, In-Reply-To, Message-ID, and From parameters, which is a fix in upstream release 1.6.20. The advisory does not describe the attack vector or the preconditions, such as whether authentication is required. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and fixed versions are 1.6.20 and 1.7.5. The Debian package versions listed in the report are roundcube/1.6.19+dfsg-1, roundcube/1.6.19+dfsg-0+deb13u1, and roundcube/1.6.5+dfsg-1+deb12u12, with the fix in roundcube/1.6.20+dfsg-1. No workaround, exploitation status, CVSS score, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.4 | CVE-2026-114724 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize()
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114724Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize()
Executive summaryThis advisory concerns Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5, where an object injection flaw in session handling is described. The advisory does not state a severity rating for this specific CVE, but the Debian bug report lists the related batch as important, and the fix is to upgrade to Roundcube 1.6.20 or 1.7.5. Technical summaryThe flaw is an object injection primitive in rcube_session::unserialize(), triggered by session keys with a "!" prefix, per the advisory text. The advisory does not state the attack vector, required privileges, or exploitation status. Affected versions are stated as Roundcube before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1 with found versions 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12. The advisory does not state a CVSS score, a workaround, or detection guidance for this issue. The Debian report says the fix is in the upstream 1.6.20 release, and the upgrade is the recommended remediation. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 3.7 | CVE-2026-114723 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation
RoundcubeRoundcube Webmail
|
NVD | |||
|
CVE-2026-114723Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation
Executive summaryRoundcube Webmail versions before 1.6.20, and 1.7.x versions before 1.7.5, contain a flaw that lets the image processing limits be bypassed when thumbnails are generated. The advisory does not state a severity score, but the Debian bug report that tracks it rates it important. The fix is to update Roundcube to 1.6.20 or 1.7.5 or later. Technical summaryThe advisory describes a resource limit bypass in ImageMagick handling during thumbnail generation, where processing falls back to the GD library and skips ImageMagick's resource limits. The Debian bug report ties the issue to a GD fallback during thumbnail generation, and says it is fixed upstream in 1.6.20. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5. The Debian bug report also lists package versions roundcube/1.6.19+dfsg-1, roundcube/1.6.19+dfsg-0+deb13u1 and roundcube/1.6.5+dfsg-1+deb12u12 as found, and roundcube/1.6.20+dfsg-1 as fixed. The attack vector, required privileges, and any user interaction are not stated. No workaround, exploitation status, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.5 | CVE-2026-114722 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114722Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a CSS scoping bypass in HTML messages, which the advisory describes as part of a larger batch of security fixes in the 1.6.20 and 1.7.5 releases. The advisory does not state a severity rating for this specific flaw, and the upstream fix is to update to the patched release. Technical summaryThe flaw is a CSS scoping bypass in how HTML messages are rendered, fixed by a commit described as using at-rules. The advisory does not state the attack vector, required user interaction, or privileges. Affected versions are stated as Roundcube before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1. A workaround is not stated, and no CVSS score or exploitation status is given. Detection guidance is not stated. The Debian report lists this CVE among a batch of related fixes in the same release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 3.1 | CVE-2026-114721 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114721Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw that allows the disabled_actions configuration setting to be bypassed. The advisory does not state a severity rating for this specific issue, though the Debian bug report that tracks the batch of fixes is marked important. The fix is to update to Roundcube 1.6.20 or 1.7.5, as the advisory and linked release notes indicate. Technical summaryThe flaw is a bypass of the disabled_actions configuration setting, which the advisory attributes to deprecated action aliases that were not checked against the setting. The advisory does not state the attack vector, required privileges, or user interaction needed. Affected versions are stated as Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5, and the Debian report lists found versions roundcube/1.6.5+dfsg-1+deb12u12, roundcube/1.6.19+dfsg-1, and roundcube/1.6.19+dfsg-0+deb13u1, with fixed version roundcube/1.6.20+dfsg-1. No workaround, CVSS score, detection guidance, or exploitation status is stated for this issue. The same batch of upstream fixes includes many other flaws, but this advisory concerns only the disabled_actions bypass. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-114720 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114720Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a set of security flaws, including an IMAP command injection issue, that the advisory describes as a batch of multiple vulnerabilities. The advisory does not state a severity score for the issue, and the Debian bug report that it draws on rates the batch as important. The fix is to update to Roundcube 1.6.20 or 1.7.5, or to the fixed Debian package 1.6.20+dfsg-1. Technical summaryThe advisory's headline describes an IMAP command injection caused by CRLF characters in parameters, which the Debian report ties to the _uid parameter of mail/headers and mail/viewsource and to the _flag parameter of the mail/mark action. The Debian report lists many other fixes, including SSRF filter bypass, remote content blocking bypass, mail header injection, XSS, CSRF bypass, and object injection in rcube_session::unserialize(), and it associates CVE IDs from CVE-2026-114714 through CVE-2026-114732 and CVE-2026-113386 with these items. Affected versions are stated as roundcube 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12, and the fixed version is stated as 1.6.20+dfsg-1; the upstream fix version for the 1.7.x branch is stated only as 1.7.5 in the Debian report's reference to upstream release notes. Attack preconditions, authentication requirements, CVSS scores, exploitation status, and detection guidance are not stated. Workarounds are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 3.7 | CVE-2026-114719 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin
RoundcubeRoundcube Webmail, Roundcube markasjunk plugin
|
NVD | |||
|
CVE-2026-114719Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin
Executive summaryA cross-site request forgery protection bypass affects Roundcube Webmail versions before 1.6.20 and the 1.7.x line before 1.7.5, in the mark-as-junk action of the markasjunk plugin. The advisory does not state a severity score, but the Debian bug report that tracks it rates it important. The fix is to update Roundcube Webmail to 1.6.20 or 1.7.5 or later, as the upstream fixes are in those releases. Technical summaryThe flaw is a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin, which allows a forged request to be accepted as legitimate. The advisory does not state the exact attack preconditions, such as whether the victim must be logged in or must visit an attacker-controlled page. Affected versions are stated as Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5, and fixed versions are 1.6.20 and 1.7.5. No workaround is stated in the advisory. No CVSS score, exploitation-in-the-wild status, or detection guidance is stated. The Debian bug text lists this CVE among a batch of other Roundcube fixes, but this advisory itself covers only the mark-as-junk CSRF issue. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 4.7 | CVE-2026-114718 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114718Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a cross-site scripting flaw in the password plugin. The advisory is part of a larger batch of Roundcube security fixes described in a Debian bug report, and the fixes are shipped in upstream release 1.6.20 and 1.7.5. The advisory does not state a severity score for this specific CVE. Technical summaryThe flaw is a cross-site scripting (XSS) issue in handling of password driver error responses in the Roundcube password plugin, per the upstream fix list quoted in the Debian bug report. The advisory does not state the attack vector or user interaction required, nor a CVSS score. Fixed versions are stated as Roundcube 1.6.20 (Debian package roundcube/1.6.20+dfsg-1) and 1.7.5 for the 1.7.x branch. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5. The advisory does not state any workaround or detection guidance for this issue. The Debian report lists the same fix as part of a batch of many other issues, and the CVE mapping in the report links this XSS fix to CVE-2026-114718. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 4.0 | CVE-2026-114717 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment
RoundcubeRoundcube Webmail
|
NVD | |||
|
CVE-2026-114717Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a mail header injection flaw that occurs when a message is forwarded as an attachment. The advisory does not state a severity rating, and it does not explicitly give a vendor recommendation beyond the fixed versions. Upgrading to 1.6.20 or 1.7.5 or later addresses the flaw. Technical summaryThe weakness is mail header injection, which the Debian bug report traces to the subject of a message forwarded as an attachment. The advisory does not state the attack vector, the required privileges or user interaction, or whether the flaw is remotely exploitable. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and the fixed versions are 1.6.20 and 1.7.5. No workaround is stated, no detection guidance is stated, and no CVSS score or exploitation-in-the-wild information is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.5 | CVE-2026-114716 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114716Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a mail header injection vulnerability, and it is part of a larger batch of security fixes in the Debian bug report. The advisory does not state a severity score for this CVE, and it describes the Debian bug as important. The fix is to update to Roundcube 1.6.20 or 1.7.5, and Debian has shipped roundcube 1.6.20+dfsg-1 for this batch. Technical summaryThe CVE entry describes a mail header injection flaw in Roundcube Webmail. The Debian bug report lists the CVE-2026-114716 mapping to a fix titled 'mail header injection via media type in an inline image data URI', which is one of 19 fixes in the 1.6.20 release, and the report links the CVE to that commit. Versions before 1.6.20 and 1.7.x before 1.7.5 are stated as affected, and the fixed versions are 1.6.20 and 1.7.5, with Debian's fixed package named roundcube/1.6.20+dfsg-1. The advisory does not state the attack vector, required privileges, or user interaction needed. It does not state a CVSS score, workarounds, or detection guidance, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.8 | CVE-2026-114715 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin
Roundcube, modoboaRoundcube Webmail, modoboa
|
NVD | |||
|
CVE-2026-114715Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by an incorrect authorization flaw in the Modoboa driver of the password plugin, which the Debian bug report notes allowed the password to be changed for another account. The advisory does not state a severity rating or a CVSS score, but the Debian report is marked important, and the recommended action is to update to Roundcube 1.6.20 or 1.7.5 or later, with Debian fixing it in roundcube 1.6.20+dfsg-1. Technical summaryThe flaw is classed as incorrect authorization in the Password plugin's Modoboa driver, and the Debian changelog describes it as a bug where the driver could change the password for another account. The advisory does not state the attack vector, required privileges or user interaction. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and the fixed versions are 1.6.20 and 1.7.5, with Debian's fixed package listed as roundcube 1.6.20+dfsg-1. No workaround is stated. Exploitation in the wild is not stated, and no detection guidance is given beyond the upstream release notes referenced in the report. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114714 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin
RoundcubeRoundcube Webmail
|
NVD | |||
|
CVE-2026-114714Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin
From the advisoryRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash. Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-113386 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection
RoundcubeRoundcube Webmail
|
NVD | |||
|
CVE-2026-113386Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection
From the advisoryRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands. Impact if exploitedConfidentialityLow IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6579-1 |
roundcube security update
Debian, RoundcubeDebian Linux, roundcube, Debian roundcube
|
Debian Security Advisories | |||
|
DSA-6579-1CVE-2026-113386CVE-2026-114714CVE-2026-114715CVE-2026-11471615 moreroundcube security update
Executive summaryDebian has released a security update for the roundcube webmail package, which fixes multiple vulnerabilities that could lead to information disclosure, cross-site scripting, or privilege escalation. The advisory does not state a severity rating for these issues. Debian recommends upgrading roundcube packages to the fixed version. Technical summaryThe advisory lists multiple vulnerabilities in roundcube, including IMAP command injection, cross-site scripting, SSRF bypass, email header injection, CSS property injection, remote content blocking bypass, information disclosure, and privilege escalation, spanning twenty CVE identifiers. Attack vector, required privileges, and user interaction are not stated. For Debian stable (trixie), the fixed version is 1.6.20+dfsg-0+deb13u1. No workarounds, detection guidance, or exploitation status are stated, and affected versions prior to the fix are not stated. The advisory points to the Debian security tracker for further status details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00495.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||