UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126813

Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid

Severity
High 7.4
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
1.6.21, 1.7.6
Weakness
CRLF injection (CWE-93)
Attack
Over the network · Only under certain conditions · No login needed · Needs someone to click or open something
Attacker can
Read data · Change data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.

From the CVE Program.

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cna:roundcube|webmail
  • Every version before 1.6.21
  • From 1.7.0 before 1.7.6

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126813