Roundcube Security Update Fixes 17 Flaws in Webmail Versions 1.6.21 and 1.7.6
Do Son 
TL;DR
Roundcube released versions 1.6.21 and 1.7.6 on November 9, 2026, fixing 17 security bugs in its open-source webmail client. This Roundcube security update covers both the 1.6 LTS branch and the current 1.7 line. The bugs range from Sieve script injection to SSRF and CSRF bypasses.
No CVE IDs or in-the-wild attacks have been confirmed so far. Admins should update all production servers now.
Why It Matters
Attackers have targeted Roundcube many times before. In fact, CISA’s Known Exploited Vulnerabilities catalog lists 11 older Roundcube flaws, two of them added in February 2026. As a result, unpatched webmail servers remain an attractive entry point.
The team was blunt in its Roundcube 1.6.21 and 1.7.6 security announcement: “We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.”
How the Attack Works
The fixes fall into a few groups.
Injection bugs
Crafted input could inject Sieve script rules, mail headers, HTTP requests or IMAP commands. For example, one bug allowed CRLF characters in an IMAP parameter when message caching was on.
Request forgery and bypasses
Two SSRF filter bypasses abused nip.io, sslip.io and 6to4 addresses. Meanwhile, three CSRF gaps let other sites trigger actions such as mail purges or managesieve deletions. Another bug bypassed the disabled_actions setting by swapping a hyphen for an underscore.
Other issues
The release also fixes an open redirect, a CPU-exhaustion denial of service, and unsafe attachment data passed to ImageMagick.
Affected Versions
- Roundcube Webmail 1.6.20 and earlier
- Roundcube Webmail 1.7.5 and earlier
Patch and Mitigation
Install 1.6.21 or 1.7.6 from the official Roundcube download page. Users on 1.6 should also plan a move to 1.7. The project warns that “1.6 will be discontinued rather soon,” because backporting fixes has become “time consuming, annoying and error prone.” Applying this Roundcube security update now closes all 17 gaps.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
