TL;DR Roundcube released versions 1.6.21 and 1.7.6 on November 9, 2026, fixing 17 security bugs in its open-source webmail client. This Roundcube security update covers both the 1.6 LTS branch and the current 1.7 line. The bugs range from Sieve script injection to SSRF and CSRF bypasses. No CVE IDs or in-the-wild attacks have been confirmed so far. Admins should update all production servers now.

Er zijn updates verschenen voor versies 1.6 en 1.7 van Roundcube Webmail die diverse beveiligensproblemen moeten verhelpen. Roundcube Webmail biedt een webinterface om e-mail te kunnen lezen en verzenden. Het heeft onder andere ondersteuning voor gedeelde mappen en namespaces, internationalized domain names en SMTP-afleverstatusnotificaties. Daarnaast is de gebruikersinterface voor IMAP-mappen aangepast om zo meer ruimte te bieden voor extensies en plug-ins. De releasenotes voor beide versies kan hieronder worden gevonden. Security updates 1.6.21 and 1.7.6 released

# Roundcube Webmail Exposure Needs Host and Mailbox Context Roundcube is a webmail client, so an external observer may see a login page without seeing the mail server, the mailbox database, or the authentication policy behind it. A product fingerprint can locate Roundcube-related web surfaces and help compare them with known deployments. It cannot establish that a mailbox is compromised or that a particular plugin is enabled. The selected count-only query was `app="Roundcube"` with scope `all`, page 1, and one result. The observation from 2026-11-03 returned 62,319 matching assets. This is a fingerprint population. It should be described with the query and time, not as 62,319 exposed mailboxes. ## Separate the web tier from mail authority Inventory the webmail hostname, reverse proxy, authentication endpoint, IMAP backend, and session store as separate assets. A public web tier may be intentionally reachable while the mail store is private. A discovered hostname can be more useful than a raw count because it gives the owner a concrete system to compare with DNS and certificate records. Check whether the Roundcube login is protected by rate limiting, multi-factor authentication, and secure session settings. Review reverse-proxy headers and URL handling, because a webmail deployment often trusts forwarded host and protocol values. Confirm that administrative or configuration directories are not served by the public document root. ## Do not infer mailbox impact The query does not show which accounts exist, whether passwords are weak, or whether a mail server has been compromised. Those questions require authorization and access to the organization's mail logs and account records. A matching asset may be a demo, a vendor service, a personal installation, or a production system. For an owned deployment, compare the external host with DNS records and inventory. If the host is unexpected, determine whether it belongs to a migration, a forgotten tenant, or third-party infrastructure. If it is expected, verify the version and plugin inventory from an authenticated management process. Do not use remote probing to test plugin vulnerabilities without a written scope. ## Report a measured lead Store the exact query, scope, page, time, count, and any evidence of a response. Use the count to prioritize the review, not to conclude that the internet-facing Roundcube population is affected by a current vulnerability. A failed query or an empty response is an evidence gap, not a zero-result finding. The operational action is an owner review with four outputs: the hostname, the responsible team, the authentication and patch state, and the decision to keep, restrict, or retire the service. ZoomEye helps surface candidates outside the inventory. The mail team supplies the context that determines the risk. ## References * Roundcube, Roundcube documentation * Roundcube, Installation notes * ZoomEye, ZoomEye

RoundCube plugin for email templates. Contribute to icarusfactor/design development by creating an account on GitHub.

オープンソースのウェブメールソフト「Roundcube Webmail」の開発元は10月19日、20件のセキュリティ上の欠陥を修正した更新版1.6.20と1.7.5を公開した。メールサーバーへの不正な命令の挿入やメールヘッダーの改ざん、外部画像の読み込み防止機能のすり抜けなどを直した。開発元は1.6系と1.7系を使うすべての環境に更新を強く勧めている。JPCERT/CCも10月28日の週報で取り…

Roundcube Webmailには、複数の脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

CERT Polska published three CVEs for the twofactorgauthenticator plugin. Every version before commit 4640889 is affected, and the fix exists only as a commit, with no tagged release.

Free and open source webmail software for the masses, written in PHP