CVE Catalog
CVE-2026-75002
HighCVSS 7.1Exploitation Probability (EPSS)
Elevated risk1.32%
69th percentile - higher than 69% of all known CVEs
Summary
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.
Risk Assessment
An attacker could exploit this to read sensitive data or gain elevated privileges in the mail system.
Recommendation
Update Roundcube to version 1.6.18 or 1.7.3 (or later) and monitor IMAP logs.
Original NVD description (English source)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.