IMAP Command Injection Vulnerability in Roundcube Webmail
CVE-2026-126813

7.4HIGH

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126813?

Roundcube Webmail prior to version 1.6.21 and the 1.7.x series before 1.7.6 is vulnerable to an IMAP command injection. This flaw arises from the ability of attackers to inject commands through the CRLF in the _uid parameter when the messages_cache feature is enabled. By enticing logged-in users to click on specially crafted GET links to endpoints such as mail/show or mail/get, attackers can execute any IMAP commands. Potential exploits could include manipulating message states, deleting messages, or altering mailbox permissions through SETACL commands.

Affected Version(s)

Webmail 0 < 1.6.21

Webmail 1.7.0 < 1.7.6

References

https://github.com/roundcube/roundcubemail/commit/4cb1cf1...
patch
https://github.com/roundcube/roundcubemail/commit/d1dda13...
patch
https://github.com/roundcube/roundcubemail/commit/2ea6369...
patch

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dexx-tech
.