{"id":"CVE-2026-114726","kind":"vulnerability","aliases":["CVE-2026-114726"],"related":[],"title":"Roundcube Webmail: bounce action lets crafted sender names inject mail headers","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.","summary":"Roundcube Webmail fails to strip control characters from a decoded From display name when a user bounces a message. A received message with CRLF sequences in an encoded word can inject arbitrary headers into the bounced mail.","severity":"medium","cvss":5.8,"epss":0.0033,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","package","roundcube","self-hosted","webmail"],"not_affected_if":["managed-hosting","patched-version"],"how_to_check":"- Check the installed version, for example `grep -r \"RCMAIL_VERSION\" program/include/iniset.php` in the Roundcube install directory\n- Confirm whether the bounce (resend) feature is in use for the mail accounts served","fix":"- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6 line, or to `1.7.5` or later on the 1.7 line\n- Apply the upstream commit \"Fix mail header injection via the From display-name in the Bounce (resend) action\" if upgrading is not possible","status":"open","published_at":"2026-10-22T02:17:00+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:09:58+00:00","updated_at":"2026-10-25T04:09:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:09:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6 line, or to `1.7.5` or later on the 1.7 line\n- Apply the upstream commit \"Fix mail header injection via the From display-name in the Bounce (resend) action\" if upgrading is not possible","reach":"internet","title":"Roundcube Webmail: bounce action lets crafted sender names inject mail headers","impact":"medium","summary":"Roundcube Webmail fails to strip control characters from a decoded From display name when a user bounces a message. A received message with CRLF sequences in an encoded word can inject arbitrary headers into the bounced mail.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","webmail","email"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker injects extra mail headers into messages sent by users","analyst_note":"","how_to_check":"- Check the installed version, for example `grep -r \"RCMAIL_VERSION\" program/include/iniset.php` in the Roundcube install directory\n- Confirm whether the bounce (resend) feature is in use for the mail accounts served","needs_analyst":false,"not_affected_if":["patched-version","managed-hosting"],"who_is_affected":"Teams running self-hosted Roundcube Webmail before 1.6.20 or 1.7.x before 1.7.5 are exposed when users bounce incoming messages. An attacker must send a crafted message with an encoded From display name, so the risk depends on mail reaching users who use bounce. Hosts on managed webmail services or on patched versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000647,"input_tokens":3447,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114726':14A,17A '-2026':13A,16A '1.6.20':65C '1.7':67C '1.7.5':70C 'action':4A,83C,148C 'address':87C 'affect':72C 'arbitrari':56B,117C 'bounc':3A,41B,60B,81C,126C,146C 'carri':108C 'charact':31B,93C 'commit':133C 'control':30B,92C 'could':115C 'craft':6A 'crlf':48B,109C 'cve':12A,15A 'decod':34B,86C,96C 'display':36B,97C,106C,142C 'display-nam':105C,141C 'email':18B 'emit':122C 'encod':52B,113C 'fail':27B 'fix':129C,134C 'header':11A,57B,76C,118C,136C 'host':23B 'inject':9A,55B,77C,116C,137C 'let':5A 'list':88C 'mail':10A,61B,75C,135C 'messag':43B,46B,102C,121C 'mime':85C 'name':8A,37B,98C,107C,143C 'packag':19B 'rcube':84C 'receiv':45B,101C 'resend':82C,147C 'roundcub':1A,20B,25B,62C 'self':22B 'self-host':21B 'sender':7A 'sequenc':49B,110C 'strip':29B,91C 'upstream':128C 'user':40B,125C 'via':138C 'vulner':78C 'webmail':2A,24B,26B,63C 'whose':103C 'word':53B,114C 'x':68C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Roundcube Webmail before 1.6.20 or 1.7.x before 1.7.5 are exposed when users bounce incoming messages. An attacker must send a crafted message with an encoded From display name, so the risk depends on mail reaching users who use bounce. Hosts on managed webmail services or on patched versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114726","severity":null,"published_at":"2026-10-22T02:17:00+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114726","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114726","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}