LDAP Injection Vulnerability in Roundcube Webmail
CVE-2026-75007

5.4MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
17 August 2026

What is CVE-2026-75007?

In Roundcube Webmail versions before 1.6.18 and in the 1.7.x series before 1.7.3, a flaw was identified wherein the LDAP search filter could be manipulated through unescaped substitution patterns (%u, %fu, %d). This issue could potentially allow an attacker to craft malicious input, leading to unauthorized information disclosure or the escalated privileges of users within the application.

Affected Version(s)

Webmail 1.6.0 < 1.6.18

Webmail 1.7.0 < 1.7.3

References

https://roundcube.net/news/2026/08/09/security-updates-1....
https://github.com/roundcube/roundcubemail/releases/tag/1...
https://github.com/roundcube/roundcubemail/commit/e6cc1e1...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.