Roundcube Webmail up to 1.6.19/1.7.4 Action rcmail::action_handler disabled_actions privileges management

Summaryinfo

A vulnerability was found in Roundcube Webmail up to 1.6.19/1.7.4 and classified as critical. Affected by this vulnerability is the function rcmail::action_handler of the component Action Handler. Executing a manipulation of the argument disabled_actions can lead to privileges management. This vulnerability appears as CVE-2026-114721. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Roundcube Webmail up to 1.6.19/1.7.4 and classified as critical. This vulnerability affects the function rcmail::action_handler of the component Action Handler. The manipulation of the argument disabled_actions with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed `disabled_actions` setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.

The advisory is shared for download at bugs.debian.org. This vulnerability was named CVE-2026-114721 since 10/22/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.6.20 or 1.7.5 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Mail Client Software

Vendor

• Roundcube

Name

• Webmail

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17
• 1.6.18
• 1.6.19
• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion