CVE-2026-114721

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5

Description An authenticated remote attacker can bypass the disabled actions configuration setting. This occurs because the system only compared the requested action name, allowing access to restricted actions via their deprecated aliases. The issue is addressed by moving the check into the action handler() function to resolve aliases before the comparison takes place.

Recommendations Update Roundcube Webmail to version 1.6.20 or later. Update Roundcube Webmail to version 1.7.5 or later.