CVE-2026-114726

Roundcube Webmail is affected by a mail header injection vulnerability in the Bounce (resend) action. Affected versions are before 1.6.20 and 1.7.x versions before 1.7.5.