Vulnerability in Roundcube Webmail Product by Roundcube

CVE-2026-114721

What is CVE-2026-114721?

The Roundcube Webmail application prior to version 1.6.20 and 1.7.5 is susceptible to a configuration bypass vulnerability. This issue arises due to the improper handling of the disabled_actions configuration setting. By exploiting this flaw, a remote authenticated attacker could invoke actions marked as disabled by leveraging their deprecated aliases, circumventing the intended restrictions designed to secure the application. The upstream has addressed this vulnerability through a recent commit that strengthens the check mechanism, ensuring a more robust approach to verifying action requests.

References