PT-2026-145470
CVE-2026-126813
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
6.8
MediumMetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messages cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.
Found an issue in the description? Have something to add? Feel free to write us 👾