CVE-2026-114721: Low severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed disabledactions setting”, which moves the check into rcmail::actionhandler() and resolves aliases before comparing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Roundcube Webmail deployments that use the disabled_actions configuration setting and run a version before 1.6.20, or a 1.7.x version before 1.7.5, are affected. Systems that do not rely on disabled_actions to restrict actions are not exposed to this specific configuration bypass.
What does an attacker need to exploit it?
The attacker must be able to authenticate remotely to the Roundcube Webmail instance. Exploitation also requires that a desired action is listed in disabled_actions and has a deprecated alias that can be requested instead.
What is the impact of a successful bypass?
An authenticated attacker can access an action that an administrator intended to disable through disabled_actions. The stated impact is limited to integrity, with no confidentiality or availability impact indicated.
How can I determine whether an instance has been affected?
Review the Roundcube version and the disabled_actions configuration. If an affected version is in use and disabled actions have deprecated aliases, requests using those aliases could have reached the otherwise disabled actions; the provided information does not identify specific aliases or logging indicators.
What should be done if immediate patching is not possible?
The provided information does not specify a workaround. Restricting access to trusted authenticated users can reduce exposure, since exploitation requires remote authentication, but updating to a fixed release is the stated remediation.