CVE-2026-126813 · Package
NO FIX YET · SEE WHAT TO DO
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 accepts CRLF characters in the _uid parameter when messages_cache is enabled, so IMAP commands can be injected. An attacker who lures a logged-in user to a crafted GET link to mail/show or mail/get can delete messages, change flags, or grant mailbox access via SETACL.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations that self-host Roundcube Webmail with the messages_cache option enabled are exposed, since the flaw is in how the server builds IMAP commands from the _uid parameter. Users who log in to such a server and open a malicious link are the path for an attacker; installations with messages_cache disabled or hosted Roundcube under a managed provider can be skipped once the provider confirms its version.
Not affected if managed-hosting, messages_cache-disabled
Who cares imap, roundcube, self-hosted, webmail
CHANGELOG and program/include/iniset.php in the install directory.messages_cache is enabled in config/config.inc.php ($config['messages_cache']).1.6.21 for the 1.6 branch.Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.7.6 for the 1.7 branch.This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.