---
id: "CVE-2026-114726"
kind: "vulnerability"
aliases: ["CVE-2026-114726"]
title: "Roundcube Webmail: bounce action lets crafted sender names inject mail headers"
severity: "medium"
cvss: 5.8
epss: 0.0033
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email", "package", "roundcube", "self-hosted", "webmail"]
not_affected_if: ["managed-hosting", "patched-version"]
published_at: "2026-10-22T02:17:00+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:09:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114726", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114726", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Roundcube Webmail: bounce action lets crafted sender names inject mail headers

Roundcube Webmail fails to strip control characters from a decoded From display name when a user bounces a message. A received message with CRLF sequences in an encoded word can inject arbitrary headers into the bounced mail.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version, for example `grep -r "RCMAIL_VERSION" program/include/iniset.php` in the Roundcube install directory
- Confirm whether the bounce (resend) feature is in use for the mail accounts served

## Fix

- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6 line, or to `1.7.5` or later on the 1.7 line
- Apply the upstream commit "Fix mail header injection via the From display-name in the Bounce (resend) action" if upgrading is not possible

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114726
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114726

## From the sources

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_