CVE-2026-114726

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114726", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-22T01:55:25.334Z", "datePublished": "2026-10-22T01:55:25.693Z", "dateUpdated": "2026-10-28T02:17:15.141Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit \u201cFix mail header injection via the From display-name in the Bounce (resend) action\u201d."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-99", "description": "CWE-99 Improper Control of Resource Identifiers ('Resource Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-22T01:55:25.693Z"}, "references": [{"tags": ["issue-tracking", "third-party-advisory"], "url": "https://bugs.debian.org/1151279"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0"}, {"tags": ["vendor-advisory", "release-notes"], "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.6.0", "versionEndExcluding": "1.6.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.0", "versionEndExcluding": "1.7.5"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-28T02:17:01.229186Z", "id": "CVE-2026-114726", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T02:17:15.141Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114726", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T02:17:01.229186Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T02:17:11.492Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "product": "Webmail", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "1.6.20", "versionType": "semver"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.debian.org/1151279", "tags": ["issue-tracking", "third-party-advisory"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0", "tags": ["patch"]}, {"url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5", "tags": ["vendor-advisory", "release-notes"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5", "tags": ["release-notes", "patch"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20", "tags": ["release-notes", "patch"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b", "tags": ["patch"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit \u201cFix mail header injection via the From display-name in the Bounce (resend) action\u201d."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-99", "description": "CWE-99 Improper Control of Resource Identifiers ('Resource Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.6.20", "versionStartIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.7.5", "versionStartIncluding": "1.7.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-22T01:55:25.693Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114726", "state": "PUBLISHED", "dateUpdated": "2026-10-28T02:17:15.141Z", "dateReserved": "2026-10-22T01:55:25.334Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-22T01:55:25.693Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "D91A1C10-A81F-420B-9DE2-078A9BBA469D", "versionEndExcluding": "1.6.20", "versionStartIncluding": "1.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "D41F4166-D4C5-4D1C-94AC-3CF3C27F1319", "versionEndExcluding": "1.7.5", "versionStartIncluding": "1.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit \u201cFix mail header injection via the From display-name in the Bounce (resend) action\u201d."}], "id": "CVE-2026-114726", "lastModified": "2026-10-29T14:16:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114726", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-28T02:17:01.229186Z", "version": "2.0.3"}}]}, "published": "2026-10-22T02:17:00.640", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "Mailing List"], "url": "https://bugs.debian.org/1151279"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-99"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "roundcubemail: roundcubemail: Mail header injection via crafted From display name in bounce action", "id": "2558740", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558740"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit \u201cFix mail header injection via the From display-name in the Bounce (resend) action\u201d.", "A flaw was found in Roundcube Webmail. This vulnerability allows a remote attacker to inject arbitrary email headers by sending an email containing encoded carriage return and line feed (CRLF) control characters within the sender display name. When an affected user bounces or resends the message, the application fails to strip these control characters, causing injected headers to be included in the outgoing email and potentially enabling email spoofing or unintended message routing."], "mitigation": {"lang": "en:us", "value": "Update to roundcubemail 1.6.20 or 1.7.5. As a workaround, avoid using the Bounce (resend) action on untrusted messages until updated."}, "name": "CVE-2026-114726", "public_date": "2026-10-22T01:55:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114726\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114726\nhttps://bugs.debian.org/1151279\nhttps://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b\nhttps://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.20\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.5\nhttps://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "statement": "Roundcube Webmail did not strip control characters from the decoded From display-name in rcube_mime::decode_address_list(). A remote attacker could send a message with encoded CRLF in the sender display name; when a user bounces (resends) it, arbitrary headers could be injected into the outgoing message, potentially enabling email spoofing or unintended message routing. Fixed in 1.6.20 and 1.7.5.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.0,1.6.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.0,1.7.5)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Webmail", "source": "cna", "vendor": "Roundcube"}, "product": "webmail", "vendor": "roundcube"}], "created": "2026-10-22T05:15:06.640074+00:00", "updated": "2026-10-29T22:15:04.255795+00:00", "vendors": ["roundcube", "roundcube$PRODUCT$webmail"]}