CVE-2026-75004

MediumCVSS 4.3

Published: 17/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Summary

Roundcube Webmail before 1.6.18 and 1.7.3 has improper rule name quoting that could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This affects only instances using the managesieve plugin.

Risk Assessment

Risk of bypassing filter management restrictions, potentially allowing unauthorized actions on mailboxes.

Recommendation

Upgrade Roundcube Webmail to 1.6.18 or 1.7.3 and review managesieve plugin configuration.

Original NVD description (English source)

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.