MSRXVulnerabilities / CVE-2026-114726
CVE-2026-114726
Published 2026-10-22 · Analyzed
CVE-2026-114726
5.8 MEDIUM
CVSS 3.1 · CNA · mitre.org
CVSS 3.1 · CNA · mitre.org
0.3%
chance of exploitation in the next 30 days (EPSS; higher than 26% of CVEs)
chance of exploitation in the next 30 days (EPSS; higher than 26% of CVEs)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
Scores
Affected products
- roundcube webmail: ≥ 1.6.0, < 1.6.20; ≥ 1.7.0, < 1.7.5
Weakness: CWE-99
6 references (advisories, patches, write-ups)
- https://bugs.debian.org/1151279 · Third Party Advisory, Mailing List
- https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b · Patch
- https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0 · Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 · Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 · Release Notes
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 · Issue Tracking
Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.