The Roundcube team released Webmail security updates 1.6.21 (1.6 LTS) and 1.7.6 on Nov 9, 2026, fixing recently reported security vulnerabilities [1]. Fixes include IMAP command injection via CRLF in the _uid parameter with messages_cache enabled, SSRF filter bypasses in the CSS proxy via nip.io/sslip.io and 6to4 addresses, Sieve script injection, and several CSRF validation bypasses; Security NEXT notes the advisory cites no CVE numbers and covers 17 fixes [1][2]. Organizations running Roundcube Webmail should upgrade to 1.6.21 or 1.7.6 promptly, as the developers strongly recommend [1][2].
MediumMonitoringOfficially confirmed
Roundcube Webmail 1.6.21 and 1.7.6 fix 17 security issues including IMAP injection and SSRF filter bypasses
1 min read
- Disclosed
- Nov 9, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 10, 2026
- CVSS basis
- Our assessment
- Exploitation and patch status
- Patch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: Roundcube Roundcube Webmail
What to do nowOur advice
- Upgrade Roundcube Webmail 1.6 LTS to 1.6.21 and the 1.7 branch to 1.7.6 [1].
- Review the full changelogs for 1.6.21 and 1.7.6 on GitHub .
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| Roundcube Roundcube Webmail | unknown[1] | 1.6.21 / 1.7.6 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
- Roundcube releases security updates 1.6.21 and 1.7.6[1]
Technical details
Remediation
References
Official / primary1
- [1]
“We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail.”
Media1
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.