Improper Rule Name Quoting in Roundcube Webmail by Roundcube

CVE-2026-75004

What is CVE-2026-75004?

In specific versions of Roundcube Webmail, a vulnerability exists that allows an attacker to bypass the 'managesieve_disabled_actions' configuration through improper quoting of rule names within Sieve scripts. This issue primarily affects instances running the managesieve plugin, potentially enabling unauthorized manipulation of email filtering rules. Users are encouraged to update to the latest versions, 1.6.18 or 1.7.3, to mitigate this risk.

References