CVE-2026-114721 in Roundcube
Summary
by MITRE • 10/22/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed `disabled_actions` setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.20 and version series 1.7.x prior to 1.7.5 represents a significant logic flaw within the application's access control mechanism, specifically concerning the disabled_actions configuration directive. This setting is designed by system administrators to restrict user interaction with specific functionalities of the webmail interface for security or operational reasons. However, the implementation contained a critical oversight where the validation process relied exclusively on matching the requested action name against the list of disabled actions without accounting for historical aliases associated with those functions. Consequently, an attacker who has successfully authenticated to the application can bypass these restrictions by invoking the deprecated alias rather than the current primary identifier for the restricted feature. This flaw effectively nullifies the intended security boundary established by the administrator, allowing unauthorized execution of features that were explicitly meant to be disabled.
From a technical perspective, this issue stems from an incomplete input validation strategy within the action handling logic. The original implementation performed a direct string comparison between the incoming request parameter and the configured list of prohibited actions. Because Roundcube maintains backward compatibility by supporting deprecated aliases for various actions, the system failed to normalize or resolve these aliases before performing the security check. This oversight creates a predictable bypass vector where any action with an associated legacy name can be executed if that legacy name is not explicitly included in the disabled_actions array, even if the current canonical name of the action is listed as prohibited. The vulnerability falls under CWE-693, which pertains to Protection Mechanism Failure, specifically illustrating how a protection mechanism intended to restrict access fails due to incomplete coverage of all possible input variations or aliases.
The operational impact of this vulnerability allows remote authenticated attackers to execute restricted commands that may lead to further security compromises depending on the specific action being accessed. For instance, if an administrator has disabled actions related to exporting contacts or accessing external storage for data loss prevention purposes, an attacker could circumvent these controls and exfiltrate sensitive information. In environments where certain administrative functions are locked down for regular users, this bypass could potentially lead to privilege escalation scenarios if those restricted actions involve configuration changes or user management tasks. The severity of the impact is contingent upon which specific actions were disabled by the administrator, but the existence of any such restriction implies a higher risk profile than an unrestricted system would present. This aligns with ATT&CK technique T1078, Valid Accounts, as it leverages legitimate authentication credentials to perform unauthorized operations that violate policy constraints.
To mitigate this vulnerability, organizations running affected versions must upgrade Roundcube Webmail immediately to version 1.6.20 or later for the stable branch, or version 1.7.5 and above for the development branch. The upstream resolution involves refactoring the action handling logic within the rcmail::action_handler() method to ensure that all incoming requests are resolved against their canonical names before being compared with the disabled_actions configuration list. This ensures that both current identifiers and deprecated aliases are treated uniformly, closing the bypass vector entirely. Until an upgrade can be performed, administrators should consider implementing web application firewall rules or reverse proxy configurations to block requests containing known deprecated action aliases for functions that are critical to security policies. Additionally, reviewing existing disabled_actions lists is recommended to ensure no other legacy names have been inadvertently left open due to similar oversight in configuration management practices.