Server-Side Request Forgery Filter Bypass in Roundcube Webmail
CVE-2026-114730

7.2HIGH

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114730?

Roundcube Webmail versions prior to 1.6.20 and 1.7.5 are vulnerable to a server-side request forgery filter bypass. The issue arises because the network blocklist used by the function rcube_utils::is_local_url() incorrectly omits critical NAT64 prefixes, allowing malicious URLs that exploit NAT64 to reach sensitive loopback and link-local addresses. This vulnerability can potentially expose the system to unauthorized network requests, presenting a significant risk if left unaddressed. The vulnerability has been fixed in subsequent releases, emphasizing the importance of keeping your software updated with the latest security patches.

Affected Version(s)

Webmail 1.6.14 < 1.6.20

Webmail 1.7.0 < 1.7.5

References

https://bugs.debian.org/1151279
issue-trackingthird-party-advisory
https://github.com/roundcube/roundcubemail/commit/6e1d480...
patch
https://roundcube.net/news/2026/10/19/security-updates-1....
vendor-advisoryrelease-notes

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.