{"id":"CVE-2026-114726","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-114726","generatedAt":"2026-10-28T01:53:22.598Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received…","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.","published":"2026-10-22T02:17:01.000Z","lastModified":"2026-10-22T16:45:50.000Z","status":"Undergoing Analysis","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":5.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"cwe":["CWE-99"],"affected":[],"epss":{"score":0.00331,"percentile":0.26026,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.0033,"percentile":0.24923}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-22T02:17:01.000Z","detail":{"score":"5.8","severity":"MEDIUM","publishedAt":"2026-10-22T02:17:00.640Z"},"summary":"New CVE, medium severity (CVSS 5.8)."}],"references":[{"url":"https://bugs.debian.org/1151279","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","source":"cve@mitre.org"},{"url":"https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-114726","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}