Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-126813: Roundcube Webmail can let attackers delete or read mail
CVE-2026-126813 · published 3 days ago
Summary
If you use Roundcube Webmail versions older than 1.6.21 or 1.7.6, a malicious link can cause the server to run hidden email commands. This can let an attacker remove messages, change their status, or give themselves access to a user's mailbox. Upgrade Roundcube to the latest version or apply the vendor's patch as soon as possible.
What to do
- Update roundcube webmail to version 1.6.21 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | roundcube | webmail | < 1.6.21 |
| Ubuntu:Pro:16.04:LTS | canonical | roundcube | All versions |
| Debian:12 | debian | roundcube | All versions |
Original advisory text
Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.
References
- https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcub... Third Party Advisory
- https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901... Patch
- https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5... Patch
- https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b7... Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.21 Vendor Advisory
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.6 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-1268... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-126813 Vendor Advisory
- https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6 Vendor Advisory
- https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-i... Vendor Advisory
- https://ubuntu.com/security/CVE-2026-126813 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-126813 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-126813 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.1
Critical
Type
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
Timeline
Published11 Nov 2026
Updated15 Nov 2026
First seen11 Nov 2026
Sources
CVE-2026-126813 · NVD
CVE-2026-126813 · MITRE
CVE-2026-126813 · OSV
UBUNTU-CVE-2026-126813 · OSV
DEBIAN-CVE-2026-126813 · OSV
Track software like this
Free during beta