{"id":"CVE-2026-114721","kind":"vulnerability","aliases":["CVE-2026-114721"],"related":[],"title":"Roundcube Webmail: deprecated action aliases bypass disabled_actions setting","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed `disabled_actions` setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.","summary":"Roundcube checked disabled_actions against the action name as requested, so a logged-in user could reach a disabled action by using its deprecated alias. The attacker gets access to a feature the administrator meant to turn off, not code execution.","severity":"low","cvss":3.1,"epss":0.00296,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail","package","roundcube","self-hosted"],"not_affected_if":["default-config","fixed-version","no-disabled-actions"],"how_to_check":"- Check the installed Roundcube version in `config/defaults.inc.php` or the package manager; affected if below `1.6.20` on the 1.6 line or below `1.7.5` on the 1.7 line\n- Check whether `disabled_actions` is set in `config/config.inc.php`; the bypass only matters if an action is listed there","fix":"- Upgrade Roundcube Webmail to `1.6.20` or `1.7.5` or later\n- Until upgraded, remove reliance on `disabled_actions` for sensitive actions and restrict access at the web server level","status":"open","published_at":"2026-10-22T02:16:59+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:47:25+00:00","updated_at":"2026-10-25T04:47:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:47:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` or `1.7.5` or later\n- Until upgraded, remove reliance on `disabled_actions` for sensitive actions and restrict access at the web server level","reach":"internet","title":"Roundcube Webmail: deprecated action aliases bypass disabled_actions setting","impact":"low","summary":"Roundcube checked disabled_actions against the action name as requested, so a logged-in user could reach a disabled action by using its deprecated alias. The attacker gets access to a feature the administrator meant to turn off, not code execution.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","mail"],"confidence":0.7,"needs_auth":"yes","worst_case":"authenticated user reaches a disabled webmail action","analyst_note":"","how_to_check":"- Check the installed Roundcube version in `config/defaults.inc.php` or the package manager; affected if below `1.6.20` on the 1.6 line or below `1.7.5` on the 1.7 line\n- Check whether `disabled_actions` is set in `config/config.inc.php`; the bypass only matters if an action is listed there","needs_analyst":false,"not_affected_if":["default-config","no-disabled-actions","fixed-version"],"who_is_affected":"Only Roundcube installs that use the disabled_actions setting to turn off a feature for their users are affected, since the bypass reaches actions that setting disables. The attacker must hold a valid webmail account, so instances with open or fully trusted user bases carry the most exposure. Installs that do not set disabled_actions have nothing to bypass.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000645,"input_tokens":3448,"output_tokens":600,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-114721':12A,15A '-2026':11A,14A '1.6.20':67C '1.7':69C '1.7.5':72C 'access':51B 'action':4A,8A,25B,28B,42B,76C,87C,99C,103C,122C,126C,134C 'administr':56B 'alia':47B,110C 'alias':5A,123C,138C 'allow':73C 'attack':49B,95C 'authent':94C 'bug':119C 'bypass':6A,81C,124C 'check':23B,83C,131C 'code':62B 'commit':117C 'compar':84C,140C 'configur':77C 'could':38B,96C 'cve':10A,13A 'deprec':3A,46B,109C,121C 'disabl':7A,24B,41B,75C,102C,125C 'execut':63B 'featur':54B 'fix':113C,118C 'get':50B 'handler':135C 'host':21B 'instead':111C 'list':100C 'log':35B 'logged-in':34B 'mail':16B 'meant':57B 'move':129C 'name':29B,88C 'packag':17B 'rcmail':133C 'reach':39B,97C 'remot':93C 'request':31B,90C,105C 'resolv':137C 'roundcub':1A,18B,22B,64C 'self':20B 'self-host':19B 'set':9A,78C,127C 'turn':59B 'upstream':112C 'use':44B 'user':37B 'webmail':2A,65C 'x':70C","nicknames":[],"mitigations":[],"who_affected":"Only Roundcube installs that use the disabled_actions setting to turn off a feature for their users are affected, since the bypass reaches actions that setting disables. The attacker must hold a valid webmail account, so instances with open or fully trusted user bases carry the most exposure. Installs that do not set disabled_actions have nothing to bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114721","severity":null,"published_at":"2026-10-22T02:16:59+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114721","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114721","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}