CVE-2026-126813
mediumRoundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in th…
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_gen... disclosure@vulncheck.com
- https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80 disclosure@vulncheck.com
- https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb disclosure@vulncheck.com
- https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c disclosure@vulncheck.com
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.21 disclosure@vulncheck.com
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.6 disclosure@vulncheck.com
- https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-comman... disclosure@vulncheck.com