Vulnerability · Published Oct 22, 2026 · Assigned by mitre
CVE-2026-114726
Medium 5.8
In plain English
A medium-severity security flaw in Webmail from Roundcube. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | no fix listed | DEBIAN-CVE-2026-114726 |
| Debian:13 | roundcube | 1.6.20+dfsg-0+deb13u1 | DEBIAN-CVE-2026-114726 |
| Debian:14 | roundcube | 1.6.20+dfsg-1 | DEBIAN-CVE-2026-114726 |
| Ubuntu:26.10 | roundcube | no fix listed | UBUNTU-CVE-2026-114726 |
Affected products (as reported)
Weakness: CWE-99 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
References
- https://bugs.debian.org/1151279 issue-tracking, third-party-advisory
- https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0 patch
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 vendor-advisory, release-notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 release-notes, patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 release-notes, patch
- https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b patch