CVE-2026-114721 | Roundcube Webmail up to 1.6.19/1.7.4 Action rcmail::action_handler disabled_actions privileges management

October 22, 2026 Yanac

A vulnerability has been found in Roundcube Webmail up to 1.6.19/1.7.4 and classified as critical. Affected is the function rcmail::action_handler of the component Action Handler. Performing a manipulation of the argument disabled_actions results in improper privilege management.

This vulnerability is reported as CVE-2026-114721. The attack is possible to be carried out remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More