CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.

• CWE-918

• https://bugs.debian.org/1151279
• https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
• https://github.com/roundcube/roundcubemail/commit/6e1d480e730a45f29829b6a11af608d5d6eb3db6
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
• https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114725Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5
• CVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.8
• CVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passe…8.3
• CVE-2026-114728Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.3
• CVE-2026-114729Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.3
• CVE-2026-11473A vulnerability was identified in jflyfox jfinal_cms up to 5…6.3
• CVE-2026-114731Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…5.3
• CVE-2026-114732Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is af…6.8
• CVE-2026-11474A security flaw has been discovered in Kushan2k student-mana…7.3
• CVE-2026-11475A weakness has been identified in Kushan2k student-managemen…6.3
• CVE-2026-11476A security vulnerability has been detected in Kushan2k stude…6.3
• CVE-2026-11477A vulnerability was detected in hs-web hsweb-framework up to…4.3