{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126813", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-11T20:01:52.550Z", "datePublished": "2026-11-11T20:53:13.638Z", "dateUpdated": "2026-11-11T20:53:13.638Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-11T20:53:13.638Z"}, "datePublic": "2026-11-09T12:01:09.000Z", "title": "Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid", "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')", "cweId": "CWE-93", "type": "CWE"}]}], "affected": [{"vendor": "Roundcube", "product": "Webmail", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.6.21", "versionType": "semver", "status": "affected"}, {"version": "1.7.0", "lessThan": "1.7.6", "versionType": "semver", "status": "affected"}], "packageURL": "pkg:composer/roundcube/roundcubemail"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.0", "versionEndExcluding": "1.7.6"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb", "tags": ["patch"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c", "tags": ["patch"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80", "tags": ["patch"]}, {"url": "https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892", "tags": ["technical-description"]}, {"url": "https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6", "tags": ["vendor-advisory"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.21", "tags": ["release-notes"], "name": "Webmail 1.6.21 Release Notes"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.6", "tags": ["release-notes"], "name": "Webmail 1.7.6 Release Notes"}, {"name": "VulnCheck Advisory: Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid"}], "credits": [{"lang": "en", "value": "Dexx-tech", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:composer/roundcube/roundcubemail", "product": "Webmail", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.21", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "1.7.6", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL."}], "id": "CVE-2026-126813", "lastModified": "2026-11-12T20:28:31.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-11T21:16:45.883", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.21"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.6"}, {"source": "disclosure@vulncheck.com", "url": "https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "roundcubemail: roundcubemail: Arbitrary IMAP command execution via CRLF injection", "id": "2571918", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571918"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.", "A flaw was found in Roundcube Webmail. When message caching is enabled, the application fails to properly sanitize the message identifier parameter, allowing command injection into the backend Internet Message Access Protocol (IMAP) server via Carriage Return Line Feed (CRLF) sequences. A remote attacker can exploit this by tricking an authenticated user into opening a specially crafted link. Successful exploitation allows the attacker to execute arbitrary IMAP commands within the victim's session, potentially leading to unauthorized mailbox access, altered message flags, or message deletion."], "mitigation": {"lang": "en:us", "value": "Disable message caching in the Roundcube configuration to prevent processing CRLF sequences through the cached message workflow.\n1. Edit the Roundcube configuration file (typically `/etc/roundcubemail/config.inc.php`) and ensure message caching is disabled:\n```php\n$config['messages_cache'] = false;\n```\n2. Reload the web server or PHP process manager for changes to take effect:\n```bash\nsystemctl reload php-fpm\n```\nor\n```bash\nsystemctl reload httpd\n```\nCaveats: Disabling message caching causes Roundcube to query the IMAP server directly for message contents and structure, which can increase IMAP server workload and introduce slight latency during message browsing. Reloading web services may temporarily disrupt active client sessions."}, "name": "CVE-2026-126813", "public_date": "2026-11-11T20:53:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126813\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126813\nhttps://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892\nhttps://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80\nhttps://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb\nhttps://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.21\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.6\nhttps://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6\nhttps://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid"], "statement": "This vulnerability is rated as having Moderate impact because exploitation requires social engineering against an authenticated user and relies on the message caching feature being activated. An attacker must induce an active webmail user to follow a crafted URL, injecting unauthorized protocol commands into the backend IMAP connection. While successful attacks can modify message states or alter mailbox permissions within the victim's session, they do not grant direct underlying system access.", "threat_severity": "Moderate"}

{"created": "2026-11-12T18:15:04.989213+00:00", "updated": "2026-11-12T18:15:04.989216+00:00", "vendors": []}