CVE-2016-9920 — Improper Access Control in Webmail

CWE-284 — Improper Access Control10 documents7 sources
Severity
7.5HIGHNVD
OSV6.1
EPSS
38.3%
top 2.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Roundcube WebmailRoundcube Webmail
Timeline
PublishedDec 8
Latest updateMar 30

Description

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages2 packages

▶Ubunturoundcube/roundcube_webmail< 1.2~beta+dfsg.1-0ubuntu1+esm7+1
▶NVDroundcube/webmail1.1.6+3

🔴Vulnerability Details

4
OSV
roundcube vulnerabilities↗2026-03-30
▶
GHSA
GHSA-f59r-7mfp-ww98: steps/mail/sendmail↗2022-05-17
▶
CVEList
CVE-2016-9920: steps/mail/sendmail↗2016-12-08
▶
OSV
CVE-2016-9920: steps/mail/sendmail↗2016-12-08
▶

📋Vendor Advisories

2
Ubuntu
Roundcube Webmail vulnerabilities↗2026-03-30
▶
Debian
CVE-2016-9920: roundcube - steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when n...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-9920 roundcubemail: Code execution via mail()↗2016-12-09
▶
Bugzilla
CVE-2016-9920 roundcubemail: Code execution via mail() [epel-all]↗2016-12-09
▶
Bugzilla
CVE-2016-9920 roundcubemail: Code execution via mail() [fedora-all]↗2016-12-09
▶
CVE-2016-9920 — Improper Access Control in Webmail | cvebase