Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T13:16:55.070Z",
  "pubdate": "2026-08-17T13:16:55.070Z",
  "executiveSummary": "A vulnerability exists in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, specifically within the managesieve plugin. The flaw stems from improper rule name quoting, which allows an attacker to achieve a managesieve_disabled_actions setting bypass.\nThe primary impact of this vulnerability is the potential circumvention of administrative restrictions enforced by the managesieve_disabled_actions configuration. By successfully bypassing these restrictions, an unauthorized actor or standard user can create or manipulate Sieve scripts containing actions that are otherwise prohibited by the system administrator.\nThis issue exclusively affects Roundcube instances that utilize the managesieve plugin. Exploitation requires the capability to craft a malicious rule name within a Sieve script context.\nThe risk implication involves policy enforcement failure, potentially allowing users to execute disabled email filtering or redirection actions contrary to organizational security policies.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper sanitization and quoting of rule names handled by the managesieve plugin within Roundcube Webmail.\nAffected software versions include Roundcube Webmail prior to 1.6.18 and versions 1.7.x prior to 1.7.3.\nWhen processing Sieve script rules, the application fails to adequately escape or quote user-supplied rule names. This inadequacy allows structural syntax manipulation within the generated Sieve script data streams.\nThe attack flow proceeds as follows: an authenticated user leverages the managesieve interface or direct script submission mechanisms to input a specially crafted rule name containing specific characters or syntax sequences designed to break out of expected string contexts.\nBecause the rule name is improperly quoted, the parser misinterprets the injected syntax as part of the script logic rather than a literal string identifier for the rule.\nThis parsing failure enables the circumvention of the managesieve_disabled_actions security control, permitting the execution or inclusion of restricted script actions that the administrator explicitly configured to be disabled.\nThe vulnerability requires interaction with the managesieve plugin component and typically assumes access to the webmail interface where Sieve script management is exposed, depending on the specific threat model and deployment configuration."
}