CVE-2026-75004

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3

Description Improper rule name quoting in Roundcube instances using the managesieve plugin allows a bypass of the managesieve disabled actions setting. This occurs when a crafted rule name is used within a Sieve script, which is a language used for filtering email messages on the server.

Recommendations Update to version 1.6.18 or later. Update to version 1.7.3 or later.