{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "range": [
                  {
                    "fixed": "d1dda13597ceed9df49d434a8d88b758bcf6ef5c"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "range": [
                  {
                    "fixed": "2ea63692178cab5cea486c7c630901b7f6852c80"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "original_tag": "1.6.21",
                "range": [
                  {
                    "fixed": "e3ee91be63339736c38d36e0e23254a7e09570a4"
                  }
                ],
                "source": "REFERENCES_TAG"
              },
              {
                "original_tag": "1.7.6",
                "range": [
                  {
                    "fixed": "1a6635100bb18c7184441f9230a8379e6e7b3e39"
                  }
                ],
                "source": "REFERENCES_TAG"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb"
            },
            {
              "fixed": "d1dda13597ceed9df49d434a8d88b758bcf6ef5c"
            },
            {
              "fixed": "2ea63692178cab5cea486c7c630901b7f6852c80"
            },
            {
              "fixed": "e3ee91be63339736c38d36e0e23254a7e09570a4"
            },
            {
              "fixed": "1a6635100bb18c7184441f9230a8379e6e7b3e39"
            }
          ],
          "repo": "https://github.com/roundcube/roundcubemail",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126813.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "range": [
              {
                "fixed": "1.6.21"
              },
              {
                "introduced": "1.7.0"
              },
              {
                "fixed": "1.7.6"
              }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
          }
        ]
      },
      {
        "extracted_events": [
          {
            "range": [
              {
                "fixed": "1.6.21"
              },
              {
                "introduced": "1.7.0"
              },
              {
                "fixed": "1.7.6"
              }
            ],
            "source": "CPE_FIELD",
            "strategy": "CPEApplicability"
          }
        ]
      },
      {
        "extracted_events": [
          {
            "range": [
              {
                "fixed": "1.6.21"
              },
              {
                "introduced": "1.7.x"
              },
              {
                "fixed": "1.7.6"
              }
            ],
            "source": "DESCRIPTION"
          }
        ]
      }
    ]
  },
  "details": "Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.",
  "id": "CVE-2026-126813",
  "modified": "2026-11-14T02:30:22.418390966Z",
  "published": "2026-11-11T20:53:13.638Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126813.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.21"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126813"
    },
    {
      "type": "ADVISORY",
      "url": "https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid"
    },
    {
      "type": "FIX",
      "url": "https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80"
    },
    {
      "type": "FIX",
      "url": "https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb"
    },
    {
      "type": "FIX",
      "url": "https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid"
}