CVE-2026-114726 (CVSS 5.8)

Description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Is your site exposed to CVE-2026-114726?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

EPSS — Exploit Prediction

0.0040

Probability of exploitation

0.34%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-99 CWE-99

References

Other References

https://bugs.debian.org/1151279 https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0 https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5

Frequently Asked Questions

What is CVE-2026-114726? +

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”. It has a CVSS v3.1 base score of 5.8 (MEDIUM).

How severe is CVE-2026-114726? +

CVE-2026-114726 has a CVSS v3.1 score of 5.8 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0040, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-114726? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-43491 9.8

A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which …

CVE-2025-2410 9.1

Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become …

CVE-2025-0756 9.1

Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before …

CVE-2024-57971 9.1

DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at …

CVE-2024-5706 8.8

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it …

CVE-2026-114716 8.5

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media …

CVE-2026-114726