{"id":"CVE-2026-126813","kind":"vulnerability","aliases":["CVE-2026-126813"],"related":[],"title":"Roundcube Webmail: crafted links inject IMAP commands into mailboxes","description":"Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.","summary":"Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 accepts CRLF characters in the _uid parameter when messages_cache is enabled, so IMAP commands can be injected. An attacker who lures a logged-in user to a crafted GET link to mail/show or mail/get can delete messages, change flags, or grant mailbox access via SETACL.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imap","package","roundcube","self-hosted","webmail"],"not_affected_if":["managed-hosting","messages_cache-disabled"],"how_to_check":"- Check the installed Roundcube version in the footer of the login page or in `CHANGELOG` and `program/include/iniset.php` in the install directory.\n- Check whether `messages_cache` is enabled in `config/config.inc.php` (`$config['messages_cache']`).","fix":"- Roundcube Webmail `1.6.21` for the 1.6 branch.\n- Roundcube Webmail `1.7.6` for the 1.7 branch.","status":"open","published_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","triaged_at":"2026-11-11T21:30:47+00:00","updated_at":"2026-11-11T21:30:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T21:30:47Z","model":"claude-haiku-5-5","output":{"fix":"- Roundcube Webmail `1.6.21` for the 1.6 branch.\n- Roundcube Webmail `1.7.6` for the 1.7 branch.","reach":"internet","title":"Roundcube Webmail: crafted links inject IMAP commands into mailboxes","impact":"medium","summary":"Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 accepts CRLF characters in the _uid parameter when messages_cache is enabled, so IMAP commands can be injected. An attacker who lures a logged-in user to a crafted GET link to mail/show or mail/get can delete messages, change flags, or grant mailbox access via SETACL.","audience":"businesses","category":"package","nicknames":[],"who_cares":["roundcube","webmail","self-hosted","imap"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker deletes messages, changes flags, or grants mailbox access","analyst_note":"Confirm the fixed versions and the exact messages_cache condition from the NVD and the linked release notes; the sources list no product ranges.","how_to_check":"- Check the installed Roundcube version in the footer of the login page or in `CHANGELOG` and `program/include/iniset.php` in the install directory.\n- Check whether `messages_cache` is enabled in `config/config.inc.php` (`$config['messages_cache']`).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["messages_cache-disabled","managed-hosting"],"who_is_affected":"Organisations that self-host Roundcube Webmail with the messages_cache option enabled are exposed, since the flaw is in how the server builds IMAP commands from the _uid parameter. Users who log in to such a server and open a malicious link are the path for an attacker; installations with messages_cache disabled or hosted Roundcube under a managed provider can be skipped once the provider confirms its version.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000833,"input_tokens":4701,"output_tokens":726,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126813':12A,15A '-2026':11A,14A '1.6.21':26B,82C '1.7':28B,84C '1.7.6':31B,87C 'accept':32B 'access':76B,138C 'allow':95C 'attack':51B,96C,111C 'cach':41B,108C 'chang':71B,133C 'charact':34B 'command':7A,46B,91C,99C,129C 'contain':88C 'craft':3A,61B,120C 'crlf':33B,101C 'cve':10A,13A 'delet':69B,131C 'enabl':43B,110C 'execut':127C 'flag':72B,134C 'get':62B,121C 'grant':74B,136C 'host':21B 'imap':6A,16B,45B,90C,128C 'inject':5A,49B,92C,98C 'link':4A,63B,122C 'log':56B,115C 'logged-in':55B,114C 'lure':53B,113C 'mail/get':67B,126C 'mail/show':65B,124C 'mailbox':9A,75B,137C 'messag':40B,70B,107C,132C 'open':119C 'packag':17B 'paramet':38B,105C 'roundcub':1A,18B,23B,79C 'self':20B 'self-host':19B 'setacl':78B,140C 'uid':37B,104C 'user':58B 'via':77B,100C,139C 'victim':117C 'vulner':93C 'webmail':2A,22B,24B,80C 'x':29B,85C","nicknames":[],"mitigations":[],"who_affected":"Organisations that self-host Roundcube Webmail with the messages_cache option enabled are exposed, since the flaw is in how the server builds IMAP commands from the _uid parameter. Users who log in to such a server and open a malicious link are the path for an attacker; installations with messages_cache disabled or hosted Roundcube under a managed provider can be skipped once the provider confirms its version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","imap","package","roundcube","selfhosted","webmail"],"campaign_type":null,"search_a":"'-126813':12A,15A '-2026':11A,14A 'command':7A 'craft':3A 'cve':10A,13A 'imap':6A 'inject':5A 'link':4A 'mailbox':9A 'roundcub':1A 'webmail':2A","search_b":"'1.6.21':26B '1.7':28B '1.7.6':31B 'accept':32B 'access':76B 'attack':51B 'cach':41B 'chang':71B 'charact':34B 'command':46B 'craft':61B 'crlf':33B 'delet':69B 'enabl':43B 'flag':72B 'get':62B 'grant':74B 'host':21B 'imap':16B,45B 'inject':49B 'link':63B 'log':56B 'logged-in':55B 'lure':53B 'mail/get':67B 'mail/show':65B 'mailbox':75B 'messag':40B,70B 'packag':17B 'paramet':38B 'roundcub':18B,23B 'self':20B 'self-host':19B 'setacl':78B 'uid':37B 'user':58B 'via':77B 'webmail':22B,24B 'x':29B","search_c":"'1.6.21':82C '1.7':84C '1.7.6':87C 'access':138C 'allow':95C 'attack':96C,111C 'cach':108C 'chang':133C 'command':91C,99C,129C 'contain':88C 'craft':120C 'crlf':101C 'delet':131C 'enabl':110C 'execut':127C 'flag':134C 'get':121C 'grant':136C 'imap':90C,128C 'inject':92C,98C 'link':122C 'log':115C 'logged-in':114C 'lure':113C 'mail/get':126C 'mail/show':124C 'mailbox':137C 'messag':107C,132C 'open':119C 'paramet':105C 'roundcub':79C 'setacl':140C 'uid':104C 'via':100C,139C 'victim':117C 'vulner':93C 'webmail':80C 'x':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126813","severity":null,"published_at":"2026-11-11T21:16:45+00:00","modified_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","fetched_at":"2026-11-11T21:29:09+00:00","note":null}],"documents":[{"id":128996,"url":"https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128997,"url":"https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128998,"url":"https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128999,"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.21","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129000,"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129001,"url":"https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}