Loading vulnerability…
Roundcube managesieve Disabled-Action Restriction Bypass
Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 contains an improper rule-name quoting vulnerability in the managesieve plugin. A crafted rule name in a Sieve script can bypass the managesieve_disabled_actions setting, circumventing administrator-configured restrictions on Sieve actions. Only instances using the managesieve plugin are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can circumvent administrator-configured restrictions on Sieve actions, potentially using mail-filtering actions disabled through managesieve_disabled_actions. The vulnerability does not by itself establish arbitrary code execution, cross-site scripting, or other impacts associated with separate Roundcube vulnerabilities.
If you can’t patch tonight, do this now.
Until patched, disable or limit use of the managesieve plugin where feasible and restrict untrusted users' ability to create or modify Sieve scripts.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.18 or later in the 1.6 branch, or version 1.7.3 or later in the 1.7 branch. For Debian stable (trixie), upgrade the Roundcube packages to 1.6.18+dfsg-0+deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.