Roundcube Webmail CVE-2026-75002

Exploitation requires the attacker to hold a valid authenticated Roundcube session, corresponding to any mailbox account hosted on the instance (PR:L per CVSS vector) - no administrative or elevated account is needed. The backend IMAP server must support and advertise the LITERAL+ capability (RFC 2088); IMAP servers that do not advertise LITERAL+ are not exploitable via this path. Attack complexity is rated High (AC:H), indicating the desynchronization condition depends on specific IMAP server behavior and may not be reliably triggerable across all server implementations or configurations. No victim user interaction is required (UI:N), and the attack is initiated remotely over the network (AV:N). What limits exploitation: attackers must already possess a legitimate credential for the Roundcube instance; the AC:H condition means exploitation may require trial-and-error tuning to a specific IMAP server's LITERAL+ parsing behavior; and the S:U scope boundary means injected commands execute within the IMAP protocol session context rather than achieving OS-level code execution.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L presents a nuanced risk profile: the flaw is network-exploitable with no user interaction required, but demands both a valid authenticated session (PR:L) and specific IMAP server-side conditions around LITERAL+ support (AC:H), tempering immediate mass-exploitation concern. The C:H/I:H impact metrics reflect the potential for full mailbox content disclosure and privilege escalation within the IMAP server context, which is severe for multi-tenant or organizational deployments. No EPSS score was provided in the source data, so exploitation probability cannot be quantitatively assessed; the absence of a KEV entry and lack of identified public POC further reduce immediate automated-exploitation risk. However, the responsible disclosure came from Zach Hanley of Horizon3.ai, a firm with a documented record of weaponizing webmail injection flaws, which meaningfully raises the likelihood that functional exploit code will emerge - even a mid-sized municipal IT team in gdynia relying on self-hosted Roundcube for government communications should treat this as an urgent patching priority rather than a deferred maintenance item. The S:U scope rating limits the blast radius to the webmail and IMAP layer, mitigating broader infrastructure compromise, but mailbox-level privilege escalation between users in a shared environment represents a significant breach of confidentiality and integrity boundaries.

An attacker with a valid low-privilege mailbox account on the Roundcube instance crafts a mail search query embedding malformed LITERAL+ byte-count boundaries, causing the IMAP server to interpret injected bytes as standalone IMAP commands issued under the webmail service account's authority. This allows the attacker to issue commands such as SELECT or FETCH against mailboxes belonging to other users, effectively escalating from their own mailbox scope to arbitrary mailbox access. No public POC has been identified at time of analysis, but the specificity of the researcher's disclosure and Horizon3.ai's publication history suggest a working exploit may follow.