Roundcube Webmail CVE-2026-114726

Exploitation requires that the victim be a Roundcube Webmail user running a version before 1.6.20 or 1.7.x before 1.7.5, and that this user actively invoke the Bounce (resend) action on an attacker-controlled email. The attacker's prerequisite is only the ability to deliver an email containing a From display-name with CRLF control characters embedded in an RFC 2047 encoded word; no authentication to Roundcube is needed by the attacker. The key limiting factor is the mandatory victim interaction (the Bounce action is not a default/automatic operation), which bounds this to targeted social-engineering-style abuse rather than automated mass exploitation; impact is confined to injected headers in the resent message (integrity), with no confidentiality or availability effect.

This is a genuine but moderate-severity flaw, not a top-priority emergency. The input provides a CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, base 5.8) with only Integrity impact (I:L) and a changed scope, which is consistent with header injection rather than data theft or code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - exploitation is plausible but not demonstrated to be occurring. The single biggest signal conflict is UI: the supplied vector claims UI:N, yet the description makes clear a logged-in user must actively invoke the Bounce (resend) action on an attacker-supplied message for the injected CRLF headers to take effect, which strongly implies UI:R. This user-interaction dependency materially lowers real-world risk below what the 5.8 network-vector score suggests. Note the 'RCE' tag is inconsistent with the vector and description - there is no code-execution or confidentiality/availability impact here; this is a CWE-99-class mail header injection. Treat as a routine patch-management item for Roundcube operators, prioritized by exposure rather than as an actively exploited threat.

An attacker sends a crafted email to a Roundcube user whose From display-name contains CRLF sequences hidden inside an RFC 2047 encoded word. When the victim later uses the Bounce (resend) action on that message, rcube_mime::decode_address_list() emits the unsanitized display name, injecting arbitrary headers (e.g. extra recipients or routing headers) into the outgoing message. No public exploit is identified at time of analysis, but the fix commit ships a unit test demonstrating the injection technique.