CVE-2026-75004
published 2026-08-17CVE-2026-75004: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.37%
31.1th percentile
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundcube | webmail | >= 1.6.0 < 1.6.18 | 1.6.18 |
| roundcube | webmail | >= 1.7.0 < 1.7.3 | 1.7.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Roundcube Webmail up to 1.6.17/1.7.2 managesieve plugin input validation (Nessus ID 341564 / WID-SEC-2026-2880)
vuldb·2026-08-31·CVSS 4.3
CVE-2026-75004 [MEDIUM] Roundcube Webmail up to 1.6.17/1.7.2 managesieve plugin input validation (Nessus ID 341564 / WID-SEC-2026-2880)
A vulnerability was found in Roundcube Webmail up to 1.6.17/1.7.2. It has been declared as problematic. This affects an unknown function of the component managesieve plugin. The manipulation results in improper input validation.
This vulnerability was named CVE-2026-75004. The attack may be performed from remote. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script.
ghsa_unreviewed·2026-08-17
CVE-2026-75004 [MEDIUM] CWE-77 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script.
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-17
Published