Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-74999 Details

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/roundcube/roundcubemail/commit/2d2a9604a820ee279c9ffcfe856b9b93a93995a8	[email protected]	Patch
https://github.com/roundcube/roundcubemail/commit/32f20c6bfd12dff9cfb6880ae303e740f0804fe8	[email protected]	Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.6.18	[email protected]	Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.3	[email protected]	Release Notes
https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3	[email protected]	Vendor Advisory

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Product	Versions
roundcube webmail	>= 1.6.0, < 1.6.18 >= 1.7.0, < 1.7.3
CPE cpe:2.3:a:roundcube:webmail:::::::: Remediation No remediation found in references.

3 change records found show changes

QUICK INFO