Every CVE Search/ Get API key

CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration...

3.1 LowFix available

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.30%Unchanged since Oct 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.1

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

Record
CVE-2026-114721
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-107886 3.1

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

Record
EUVD-2026-107886
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8f65-rc5r-w7c8 3.1

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration...

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

Record
GHSA-8f65-rc5r-w7c8
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD 3.1

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

Record
CVE-2026-114721
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV 3.1

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

Record
CVE-2026-114721
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVDEBIAN-CVE-2026-114721 3.1

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

Record
DEBIAN-CVE-2026-114721
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-114721 3.1

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabled_actions setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

Record
UBUNTU-CVE-2026-114721
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
roundcube
Debian:12
 All versions, plus listed versions
1.6.1+dfsg-11.6.10+dfsg-11.6.10+dfsg-21.6.11+dfsg-11.6.12+dfsg-1
Show 34 moreShow less
1.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-11.6.16+dfsg-11.6.17+dfsg-11.6.18+dfsg-11.6.19+dfsg-11.6.2+dfsg-11.6.20+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-21.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u101.6.5+dfsg-1+deb12u111.6.5+dfsg-1+deb12u121.6.5+dfsg-1+deb12u21.6.5+dfsg-1+deb12u31.6.5+dfsg-1+deb12u41.6.5+dfsg-1+deb12u51.6.5+dfsg-1+deb12u61.6.5+dfsg-1+deb12u71.6.5+dfsg-1+deb12u81.6.5+dfsg-1+deb12u91.6.5+dfsg-1~deb12u11.6.6+dfsg-11.6.6+dfsg-21.6.7+dfsg-11.6.8+dfsg-11.6.8+dfsg-21.6.9+dfsg-11.6.9+dfsg-2
 None known
roundcube
Debian:13
 before 1.6.20+dfsg-0+deb13u1, plus listed versions
1.6.11+dfsg-11.6.12+dfsg-0+deb13u11.6.12+dfsg-11.6.13+dfsg-0+deb13u11.6.13+dfsg-1
Show 11 moreShow less
1.6.14+dfsg-11.6.15+dfsg-0+deb13u11.6.15+dfsg-11.6.16+dfsg-0+deb13u11.6.16+dfsg-11.6.17+dfsg-0+deb13u11.6.17+dfsg-11.6.18+dfsg-0+deb13u11.6.18+dfsg-11.6.19+dfsg-0+deb13u11.6.19+dfsg-1
1.6.20+dfsg-0+deb13u1
roundcube
Debian:14
 before 1.6.20+dfsg-1, plus listed versions
1.6.11+dfsg-11.6.12+dfsg-11.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-1
Show 4 moreShow less
1.6.16+dfsg-11.6.17+dfsg-11.6.18+dfsg-11.6.19+dfsg-1
1.6.20+dfsg-1
roundcube
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1
Show 8 moreShow less
1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm61.2~beta+dfsg.1-0ubuntu1+esm71.2~beta+dfsg.1-0ubuntu1+esm8
 None known
roundcube
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-1
Show 8 moreShow less
1.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm31.3.6+dfsg.1-1ubuntu0.1~esm41.3.6+dfsg.1-1ubuntu0.1~esm51.3.6+dfsg.1-1ubuntu0.1~esm61.3.6+dfsg.1-1ubuntu0.1~esm71.3.6+dfsg.1-1ubuntu0.1~esm8
 None known
roundcube
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2
Show 9 moreShow less
1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm61.4.3+dfsg.1-1ubuntu0.1~esm71.4.3+dfsg.1-1ubuntu0.1~esm8
 None known
roundcube
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm51.5.0+dfsg.1-2ubuntu0.1~esm6
 None known
roundcube
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-2
Show 4 moreShow less
1.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm21.6.6+dfsg-2ubuntu0.1+esm3
 None known
roundcube
Ubuntu:26.10
 All versions, plus listed versions
1.6.11+dfsg-1
 None known
roundcube
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.6.11+dfsg-11.6.11+dfsg-1ubuntu0.26.04.1~esm1
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-114721 is a low vulnerability (CVSS 3.1) in Bulwarkmail Webmail, published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in roundcube 1.6.20+dfsg-0+deb13u1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open