Live › vulnerability › CVE-2026-114721
Go to dashboardRoundcube checked disabled_actions against the action name as requested, so a logged-in user could reach a disabled action by using its deprecated alias. The attacker gets access to a feature the administrator meant to turn off, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Roundcube installs that use the disabled_actions setting to turn off a feature for their users are affected, since the bypass reaches actions that setting disables. The attacker must hold a valid webmail account, so instances with open or fully trusted user bases carry the most exposure. Installs that do not set disabled_actions have nothing to bypass.
No product ranges from the sources yet.
config/defaults.inc.php or the package manager; affected if below 1.6.20 on the 1.6 line or below 1.7.5 on the 1.7 linedisabled_actions is set in config/config.inc.php; the bypass only matters if an action is listed there1.6.20 or 1.7.5 or laterdisabled_actions for sensitive actions and restrict access at the web server levelEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.
This page as .md · .json · in your agent: get_signal("CVE-2026-114721")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.