Is CVE-2026-75004 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-75004?

CVE-2026-75004 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-75004

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.