CVE-2026-126813: Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid

Published Nov 11, 2026

Updated

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Roundcube Webmail to a version that resolves this vulnerability.
Fixed in 1.6.21
Upgrade
Upgrade Roundcube Webmail to a version that resolves this vulnerability.
Fixed in 1.7.6

Event History

Nov 11, 2026

CVE Published

via MITRE·08:53 PM

Data Sourced

via MITRE·08:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Users of affected Roundcube Webmail installations are exposed when they are logged in and can be lured into opening a crafted GET link to the mail/show or mail/get endpoint. The issue requires messages_cache to be enabled.

What can an attacker do after a victim opens a crafted link?

The attacker can inject IMAP commands through CRLF characters in the _uid parameter. The described impact includes deleting messages, changing message flags, and granting mailbox access through SETACL.

Which releases are affected?

Roundcube Webmail versions before 1.6.21 are affected, as are 1.7.x versions before 1.7.6.

Does exploitation require authentication or user interaction?

The attacker does not need privileges, but exploitation requires a logged-in victim to open a crafted GET link. The vulnerability has high attack complexity and requires user interaction.

CVE-2026-126813: Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What can an attacker do after a victim opens a crafted link?

Which releases are affected?

Does exploitation require authentication or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What can an attacker do after a victim opens a crafted link?

Which releases are affected?

Does exploitation require authentication or user interaction?