CVE-2026-114724: High severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcubesession::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcubesession::unserialize() via “!”-prefixed session keys”, which rejects such keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Which deployments are affected?
Roundcube Webmail versions before 1.6.20 and 1.7.x versions before 1.7.5 are affected.
What access does an attacker need to exploit this issue?
An attacker must be able to influence stored session data. The provided information does not identify a separate authentication or user-interaction requirement.
What is the impact if exploitation succeeds?
The flaw provides a PHP object injection primitive through deserialization of malformed session data. The supplied severity vector rates confidentiality, integrity, and availability impact as high.
How can the issue be remediated?
Update to Roundcube Webmail 1.6.20 or 1.7.5, as applicable. The upstream fix rejects session keys prefixed with "!", preventing the malformed serialized-session reconstruction.