CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().

What is CVE-2026-114724?

CVE-2026-114724 is a high-severity vulnerability in Roundcube Webmail, published on 22 Oct 2026.

Official description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.

Weakness: CWE-502

Which versions are affected by CVE-2026-114724?

It affects 1 product.

Products include Roundcube Webmail.

How do I fix CVE-2026-114724?

Upgrade to a fixed version.

Is CVE-2026-114724 being exploited?

There is no known exploitation of CVE-2026-114724 in the wild and no public exploit code.

Other vulnerabilities in Roundcube Webmail

• CVE-2024-42009 RoundCube Webmail Cross-Site Scripting Exploited Critical 9.3
• CVE-2025-68461 RoundCube Webmail Cross-site Scripting Exploited High 7.2
• CVE-2008-5619 PHPMailer susceptible to arbitrary code execution Critical 10.0
• CVE-2024-37385 Command injection in n/a Critical 9.8
• CVE-2024-42008 Cross-site scripting in n/a Critical 9.3

All Roundcube Webmail vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-114724, GHSA-xxrc-hh9x-4pwx, UBUNTU-CVE-2026-114724.