Roundcube Webmail CVE-2026-114725

Requires an authenticated Roundcube session (valid webmail login), consistent with CVSS PR:L - this is the primary limiting factor and confines abuse to account holders, compromised accounts, or self-service/guest-account deployments. The attacker must control the References, In-Reply-To, Message-ID, or From request parameters of the message-send (rcmail_sendmail headers_input) flow and include CRLF/newline characters; the Subject and Organization headers are NOT viable because they were already sanitized before this fix. Affected deployments are Roundcube Webmail before 1.6.20 and any 1.7.x before 1.7.5. No special non-default feature or configuration toggle is required and no user interaction by a victim is needed to inject the headers.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N, base 5.0 Medium) indicates network-reachable, low-complexity exploitation that requires authentication (PR:L) and no user interaction, with only a low integrity impact and a scope change (the injected headers affect the outgoing message/recipients rather than the Roundcube host itself). The authentication requirement is the dominant limiting factor: an attacker must already hold valid webmail credentials, which contains this to insider misuse, compromised accounts, or environments offering self-service/guest accounts. No EPSS score, CISA KEV listing, SSVC decision, or POC indicator was provided in the input, so there is no signal of active exploitation or published exploit code - consistent with a low-to-moderate real-world threat. The vendor confirms a patch (Roundcube advisory 1.6.20/1.7.5 and the fixing commit), and the code evidence corroborates the root cause, so the technical claim is solid. Net: a legitimate hardening/patch priority for Roundcube operators, but absent exploitation signals it is a routine-severity fix rather than a drop-everything incident. No conflicting signals between CVSS and description were found; both agree on authenticated remote abuse.

A remote attacker with valid webmail credentials (or control of a compromised Roundcube account) composes a message and supplies crafted References, In-Reply-To, Message-ID, or From request parameters containing CRLF/newline sequences. Because rcmail_sendmail only stripped newlines from Subject and Organization, the attacker smuggles additional arbitrary headers (e.g. extra Bcc/recipients or spoofed routing headers) into the outgoing mail. No public exploit identified at time of analysis; exploitation requires authentication and no user interaction.