Roundcube Webmail CVE-2026-114724

Exploitation requires the attacker to be able to influence stored session data consumed by rcube_session::unserialize() - specifically the ability to introduce a session key prefixed with '!', which the pre-patch code treated as valueless and thereby desynchronized the serialized stream. This is NOT remote-unauthenticated against a default install: the CVSS AV:L and the 'able to influence stored session data' wording indicate a precondition of write access to session storage (typically an authenticated Roundcube session or a separate write primitive) plus high attack complexity (AC:H) to craft a valid desynchronizing payload. Successful impact further depends on the presence of a usable PHP object-injection gadget chain in the Roundcube installation or its dependencies. Affected: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5; fixed by upgrading to 1.6.20 or 1.7.5.

This is a genuine but conditional risk rather than a drop-everything emergency. The vendor-supplied CVSS of 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is internally notable: it pairs AV:L (local) and AC:H (high complexity) with PR:N (no privileges), which is unusual - the attack vector is scored as local/non-network yet supposedly requires no privileges. In practice the description's gating condition ('an attacker able to influence stored session data') is the dominant signal: reaching the vulnerable rcube_session::unserialize() path depends on first being able to write attacker-controlled bytes into stored session data, which in a typical Roundcube deployment implies prior authenticated access or a chained primitive, not anonymous network reach. The CWE-502 object injection, if reached, is high-impact (C:H/I:H/A:H) because PHP object injection can escalate to code execution or data compromise depending on available gadget chains. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation probability signals are absent - this is NOT confirmed actively exploited and no public exploit was supplied. SSVC-style read: technical impact is total (object injection), but automatability is low given the session-influence precondition and AC:H. Net: a real priority to patch for any internet-facing Roundcube instance, but the 'local + session-influence precondition' meaningfully lowers mass-exploitation likelihood compared to a raw 7.4 network bug. The AV:L vs PR:N tension should be verified against the vendor advisory.

An attacker who can place crafted bytes into a victim's stored session data (for example via an authenticated Roundcube account or a chained write primitive) inserts a session key prefixed with '!'. On the next session load, rcube_session::unserialize() emits a key with no value, desynchronizing the parser so that subsequent session bytes are interpreted as a serialized PHP value, instantiating an attacker-chosen object. No public exploit code was provided in the input, so this remains an analyzed primitive rather than a confirmed weaponized exploit.