CVE-2026-114721

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a bypass of the disabled_actions configuration setting. The root cause is that the software only compared the requested action name, allowing a remote authenticated attacker to access restricted actions by using dep...