CVE-2026-75004 in Roundcube
Summary
by MITRE • 08/17/2026
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified as CVE-2024-5891 represents a significant security flaw within the Roundcube Webmail application, specifically impacting versions prior to 1.6.18 and version 1.7.x prior to 1.7.3 when the managesieve plugin is enabled. This issue stems from improper handling of rule names during the parsing process of Sieve scripts used for email filtering management. The core technical flaw lies in how the application processes special characters within rule identifiers, allowing an attacker to craft a malicious rule name that circumvents security controls designed by the managesieve_disabled_actions configuration setting.
The managesieve plugin allows users and administrators to define server-side mail filters using the Sieve scripting language. To enhance security, Roundcube provides the managesieve_disabled_actions directive, which restricts certain powerful or dangerous actions within these scripts, such as redirecting emails to external addresses or executing system commands. The vulnerability arises because the input validation logic fails to properly quote or escape rule names before they are processed by the underlying Sieve engine. This lack of strict sanitization creates a context where special characters can alter the interpretation of the script structure, effectively bypassing the intended restrictions imposed by the disabled actions configuration.
From an operational perspective, this vulnerability allows authenticated users with access to the mail filtering interface to execute restricted operations that should be prohibited by system policy. An attacker could potentially redirect incoming messages to arbitrary external email addresses, leading to data exfiltration or phishing campaigns originating from the compromised organization's domain. Furthermore, if other disabled actions are similarly bypassed, it may enable further exploitation vectors such as executing arbitrary commands on the mail server infrastructure, depending on how the Sieve interpreter is configured and what privileges the Roundcube process holds. This undermines the principle of least privilege by allowing lower-level users to perform administrative or high-impact tasks that were explicitly disabled for security reasons.
This flaw aligns with CWE-798, which describes the use of hardcoded credentials or improper access control mechanisms, specifically in this context, it relates to CWE-20: Improper Input Validation and CWE-611: Improper Restriction of XML External Entity References if interpreted broadly as a parsing issue, but more accurately maps to CWE-749: Exposed Dangerous Method or Function due to the bypassing of security controls. In terms of attack vectors, this vulnerability facilitates actions consistent with MITRE ATT&CK technique T1560.002, Archive Collected Data via Compressed Archive, if used for exfiltration, but more directly relates to lateral movement and privilege escalation within the application context by bypassing configured restrictions. It also touches upon T1136: Create Account, as it could allow unauthorized configuration changes that persist across sessions.
Mitigation strategies must prioritize immediate software updates. Administrators running Roundcube Webmail should upgrade to version 1.6.18 or later for the stable branch, or version 1.7.3 and above for the development branch, where this input validation issue has been resolved through stricter quoting mechanisms in rule name processing. For environments unable to patch immediately due to dependency constraints, implementing a Web Application Firewall (WAF) with rules that detect and block anomalous Sieve script structures containing unescaped special characters in rule names can provide temporary protection. Additionally, reviewing the managesieve_disabled_actions configuration is advisable; while it does not fix this specific bypass, ensuring that only essential actions are enabled reduces the attack surface should similar vulnerabilities be discovered in other parts of the plugin. Regular auditing of mail filter configurations and monitoring for unusual outbound email traffic patterns can also aid in early detection of exploitation attempts.