What is the CVSS score of CVE-2026-75002?

CVE-2026-75002 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 1.3%.

Which versions of Roundcube Webmail are affected by CVE-2026-75002?

Roundcube Webmail versions before 1.6.18 and 1.7.3 contain a command injection vulnerability (CVE-2026-75002) that allows authenticated users to read other users' emails and escalate administrative…. A patch is available.

How to fix or mitigate CVE-2026-75002?

Within 24 hours, audit all Roundcube Webmail installations to identify affected versions (pre-1.6.18 and 1.7.0-1.7.2). Within 7 days, deploy vendor patches: upgrade 1.6.x installations to version 1.6.18 and 1.7.x installations to version 1.7.3, both released August 9, 2026. Within 30 days, verify patch deployment across all systems, review IMAP server logs for exploitation attempts, and confirm no unauthorized email access occurred during the vulnerability exposure window.

Roundcube Webmail CVE-2026-75002

EUVD-2026-60168 HIGH

Command Injection (CWE-77)

2026-08-17 mitre

GHSA-m462-3x7r-5r7f

Command Injection Information Disclosure Privilege Escalation Webmail Suse

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

7.1 HIGH

Network-exploitable via crafted search but requires authenticated session (PR:L) and LITERAL+ server support (AC:H); C:H/I:H reflects mailbox disclosure and cross-user privilege escalation with no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Aug 17, 2026 - 14:15 EUVD

Source Code Evidence Fetched

Aug 17, 2026 - 13:26 vuln.today

Analysis Generated

Aug 17, 2026 - 13:26 vuln.today

CVE Published

Aug 17, 2026 - 12:48 cve.org

HIGH 7.1

DescriptionCVE.org

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.

AnalysisAI

IMAP command injection in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 enables authenticated remote attackers to disclose information or escalate privileges by exploiting a desynchronization between mail search operations and LITERAL+ byte-count handling. The flaw was reported by Zach Hanley of Horizon3.ai and is classified as CWE-77 (Command Injection), with the vendor releasing patched versions 1.6.18 and 1.7.3 on 2026-08-09. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain valid Roundcube mailbox credentials

Delivery

Authenticate to Roundcube Webmail over network

Exploit

Craft search query with malformed LITERAL+ byte-count

Execution

Submit request to trigger desynchronized IMAP command construction

Persist

Injected IMAP commands processed by backend mail server

Impact

Read or manipulate other users' mailbox data

Access

Obtain valid Roundcube mailbox credentials

Delivery

Authenticate to Roundcube Webmail over network

Exploit

Craft search query with malformed LITERAL+ byte-count

Execution

Submit request to trigger desynchronized IMAP command construction

Persist

Injected IMAP commands processed by backend mail server

Impact

Read or manipulate other users' mailbox data

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to hold a valid authenticated Roundcube session, corresponding to any mailbox account hosted on the instance (PR:L per CVSS vector) - no administrative or elevated account is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L presents a nuanced risk profile: the flaw is network-exploitable with no user interaction required, but demands both a valid authenticated session (PR:L) and specific IMAP server-side conditions around LITERAL+ support (AC:H), tempering immediate mass-exploitation concern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a valid low-privilege mailbox account on the Roundcube instance crafts a mail search query embedding malformed LITERAL+ byte-count boundaries, causing the IMAP server to interpret injected bytes as standalone IMAP commands issued under the webmail service account's authority. This allows the attacker to issue commands such as SELECT or FETCH against mailboxes belonging to other users, effectively escalating from their own mailbox scope to arbitrary mailbox access. …
Remediation	Upgrade to Roundcube Webmail 1.6.18 (stable branch) or 1.7.3 (next branch), both released on 2026-08-09 and available at https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.3. … Detailed patch versions, workarounds, and compensating controls in full report.