Vulnerability Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Webmail | >= 1.6.0, < 1.6.20 |
Related Weaknesses (CWE)
References
- https://bugs.debian.org/1151279Third Party AdvisoryMailing List
- https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626Patch
- https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d67006489Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5Release Notes
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Issue Tracking
FAQ
What is CVE-2026-114726?
CVE-2026-114726 is a vulnerability with a CVSS score of 5.8 (MEDIUM). Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control chara...
How severe is CVE-2026-114726?
CVE-2026-114726 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114726?
Check the references section above for vendor advisories and patch information. Affected products include: Roundcube Webmail.