Object Injection Vulnerability in Roundcube Webmail by Roundcube

CVE-2026-114724

What is CVE-2026-114724?

An object injection vulnerability exists in Roundcube Webmail due to the mishandling of session keys prefixed with '!', allowing an attacker who can influence stored session data to exploit this weakness. When such a session key is processed, it is interpreted without its corresponding value, leading to desynchronization in subsequent session data handling. This flaw presents a significant risk of PHP object injection, allowing malicious actors to manipulate session data for unauthorized actions or access. Owners of affected versions should apply the updates provided in version 1.6.20 and 1.7.5 to mitigate this issue.

References