DEBIAN-CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated...

CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated...

CVE-2026-114721

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a bypass of the disabled_actions configuration setting. The root cause is that the software only compared the requested action name, allowing a remote authenticated attacker to access restricted actions by using dep...

CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated...

EUVD-2026-107886

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated...