Roundcube Webmail: Object injection in session handling
Summary
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 mishandles session keys prefixed with "!" in rcube_session::unserialize(). This desynchronizes the parsed session data, so an attacker who can influence stored session data can inject PHP objects. The NVD record gives CVSS 8.1 (network, high complexity, no privileges, no user interaction), while some third-party trackers rate it lower with a local attack vector.
Affected
- Roundcube Webmail 1.6.0 to before 1.6.20
- Roundcube Webmail 1.7.0 to before 1.7.5
- Older branches: Unknown.
Fixed in
- Roundcube Webmail 1.6.20
- Roundcube Webmail 1.7.5
- Distribution packages: check the vendor or distribution advisory for the fixed build.
Workaround
Unknown. No vendor workaround is documented. Updating is the fix.
Exploitation
- No public exploit found. VulDB states no exploit is available.
- CISA SSVC: Exploitation none, Automatable no.
- No evidence of in-the-wild exploitation found.
Our recommendation
- Update to Roundcube 1.6.20 or 1.7.5, or install the fixed package from your distribution.
- Confirm the installed version on the About page.
- Until patched, limit access to the webmail login, for example with VPN or IP restrictions.
- Apply the same release, which also fixes IMAP command injection and mail header injection.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Roundcube security updates 1.6.20 and 1.7.5 roundcube.net
- Roundcube 1.6.20 release github.com
- Roundcube 1.7.5 release github.com
- Upstream commit 833770d github.com
- Upstream commit 93284f3 github.com
- VulDB CVE-2026-114724 vuldb.com
- Debian security tracker: roundcube security-tracker.debian.org
- Ubuntu CVE-2026-114724 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:07.
Original description (NVD)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.
NVD references (6)
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
- https://github.com/roundcube/roundcubemail/commit/93284f3f0e13f99af37fc3b81861e142eea8a922
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.