CVE-2026-74999

Executive Summary

CVE-2026-74999 is a stored cross-site scripting (stored XSS) vulnerability in Roundcube Webmail, a widely deployed open-source webmail client. The flaw exists in the "Add to address book" action and affects Roundcube versions before 1.6.18 and 1.7.x before 1.7.3. An authenticated low-privileged attacker can persist malicious JavaScript in contact data, and when another user later views or interacts with that address book entry, the script executes in the victim's webmail session. Successful exploitation can lead to session hijacking, unauthorized access to email content, and further compromise of the mail infrastructure; no public exploit code or active in-the-wild campaigns have been confirmed by tracked sources at the time of writing.

Technical Analysis

Although the CVE record lists vendor/product as "Unknown," the NVD description explicitly identifies the affected software as Roundcube Webmail, so this report attributes the vulnerability to the Roundcube project. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation — cross-site scripting), specifically a stored XSS condition triggered by the "Add to address book" action.

The underlying mechanism is characteristic of stored XSS: user-supplied contact attributes are accepted and persisted by the webmail application without sufficient sanitization or output encoding. When the application later renders those attributes — for example, when a user views their contacts, searches the address book, or composes a message to a recipient — the malicious content is interpreted as active HTML/JavaScript instead of being displayed as inert text. The NVD description does not disclose the exact parameter names, endpoint paths, or the specific contact field affected, so the analysis here is intentionally limited to the vulnerability class rather than fabricated implementation details.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates the following characteristics:

• Network-based attack with low attack complexity.
• Requires low-privileged authentication (an attacker must be able to log in and create address book entries).
• Requires user interaction — a victim must view the poisoned contact data.
• Scope changed — the injected script executes in the context of the victim's webmail session, which is a different security context from the attacker's stored-data context.
• Low impact to confidentiality and integrity; no availability impact.

The "scope changed" element is significant: even though the stored payload lives in the attacker's contact data, execution occurs in the victim's session, broadening the blast radius beyond the attacker's own account. The EPSS score has not yet been published by FIRST.org, and no evidence of exploitation in the wild is currently available.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-74999. The attack chain below is inferred from the vulnerability class (stored XSS) and the CVSS characteristics, strictly within the bounds of the NVD description.

1. Reconnaissance / target identification. An attacker identifies exposed Roundcube Webmail instances using internet-wide scanning (e.g., Shodan queries for webmail login pages and recognizable Roundcube fingerprints). The attacker then obtains or creates a low-privileged account on the target mail server, which satisfies the PR:L requirement.

2. Triggering the flaw. The attacker authenticates to the webmail interface and invokes the "Add to address book" action. Instead of a benign contact entry, the attacker submits one or more contact attributes containing a script payload, such as an HTML script tag, an event-handler attribute (e.g., an onerror or onload handler), or obfuscated JavaScript. Because the vulnerable action fails to sanitize the input at storage time, the payload is persisted in the address book database.

3. Payload execution. At a later point, a victim user opens the address book, searches for the contact, or otherwise triggers rendering of the contact entry. The stored payload is interpreted by the victim's browser in the security context of the Roundcube webmail origin. The injected script can read session cookies (where not protected by the HttpOnly flag), issue authenticated requests on the victim's behalf, exfiltrate the displayed email content, or render phishing dialogs inside the webmail UI.

4. Post-exploitation impact. With the victim's session or cookies, the attacker can gain unauthorized access to the victim's mailbox, read confidential correspondence, modify mailbox settings, and potentially pivot to internal mail infrastructure. If the captured session belongs to a privileged user (e.g., a mail administrator), the impact could escalate to full compromise of the mail server or connected directory services. The attacker's persistence is aided by the stored nature of the payload: every user who views the poisoned contact entry is affected until the entry is discovered and removed.

No public PoC is available; the attack chain is inferred from the vulnerability class and CVSS factors.

Impact Assessment

The business impact of CVE-2026-74999 is concentrated on confidentiality and integrity of email communications, which are among the most sensitive assets in any enterprise. Email accounts routinely contain credentials, financial data, legal communications, and internal business strategy. A successful stored XSS yields the ability to read a victim's mailbox and perform actions under the victim's identity, effectively violating both confidentiality and integrity within the webmail application.

The CVSS base score of 5.4 (Medium) reflects the mitigating factors: the attacker requires a low-privilege account (PR:L) and must lure or wait for a victim to view the malicious contact entry (UI:R). However, the "scope changed" component raises the practical risk because the XSS executes in a higher-privilege context than the storage location. The target set is broad — Roundcube is a popular webmail front-end deployed by hosting providers, small-to-medium businesses, and educational institutions. Self-hosted deployments are the primary attack surface; organizations relying on managed or SaaS email platforms are generally not affected unless they self-host Roundcube.

Post-exploitation blast radius includes session hijacking, mailbox data theft, credential phishing, and potential propagation to connected services via hijacked authenticated sessions. Because email is frequently used for password resets and account recovery, a compromised mailbox can cascade into compromise of other enterprise systems. There is no availability impact in the CVSS score, so denial-of-service is not a primary concern.

Detection Guidance

The detection rules below target the vulnerability class and attack mechanism: HTTP POST requests carrying XSS payloads destined for a Roundcube Webmail interface, and web logs recording such payloads. Analysts should tune these rules for their environment and be aware that encrypted HTTPS traffic requires decryption at the inspection point or data source to be visible. False positives may arise from web application vulnerability scanners and unusual-but-legitimate HTML in contact notes fields.

Sigma Rule

title: Roundcube Webmail Stored XSS Payload in Address Book Submission
id: 5d1b4b9e-2f6c-4c1a-9a3e-1b6b74999cve
status: experimental
description: Detects POST requests to a Roundcube Webmail interface that contain typical stored-XSS payload constructs such as script tags, event handlers, and JavaScript protocol references, correlating to CVE-2026-74999.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-74999
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
    category: web
    product: generic
detection:
    selection_method:
        http.method: POST
    selection_payload:
        http.body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - 'document.cookie'
            - 'fromCharCode'
    condition: selection_method and selection_payload
falsepositives:
    - Web application security scanner traffic
    - Users legitimately pasting HTML content into contact notes fields (rare)
level: medium

YARA Rule

rule CVE_2026_74999_Roundcube_Stored_XSS
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects stored XSS payload strings associated with CVE-2026-74999 in Roundcube Webmail address book data or web logs"
        cve = "CVE-2026-74999"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "<script" ascii nocase
        $s2 = "onerror=" ascii nocase
        $s3 = "onload=" ascii nocase
        $s4 = "javascript:" ascii nocase
        $s5 = "document.cookie" ascii nocase
        $s6 = "fromCharCode" ascii nocase
        $s7 = "<img src=x" ascii nocase

    condition:
        uint16(0) != 0x5A4D and 3 of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-74999 Roundcube Webmail Stored XSS Payload in Address Book Request"; flow:established,to_server; http.method; content:"POST"; http.host; content:"roundcube"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror="; nocase; reference:cve,CVE-2026-74999; classtype:web-application-attack; sid:202674999; rev:1;)

Note: the http.host content match requires the Host header or destination hostname to contain the string "roundcube". Deployments using a different hostname should adjust this portion of the rule, or the rule can be scoped to all webmail POST traffic via site-specific customization.

Elastic Detection

network where event.category == "network" and network.protocol == "http"
  and http.request.method == "POST"
  and (wildcard(http.request.body.text, "*<script*")
       or wildcard(http.request.body.text, "*onerror=*")
       or wildcard(http.request.body.text, "*javascript:*")
       or wildcard(http.request.body.text, "*document.cookie*"))

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=pan:traffic
| search method=POST *
| search ("roundcube" OR host_header=*roundcube*)
| regex _raw="(<script|onerror=|onload=|javascript:|document\.cookie)"
| eval cve_id="CVE-2026-74999"
| table _time, src_ip, user, url, http_user_agent, http_referrer, status, bytes
| sort - _time

Wazuh OSSEC Rule

<group name="web,xss,roundcube,">
  <rule id="109749" level="10" frequency="5" timeframe="120">
    <if_sid>31100</if_sid>
    <match>onerror=|<script>|javascript:|document.cookie</match>
    <description>CVE-2026-74999 - Possible stored XSS payload in Roundcube Webmail address book submission</description>
    <group>attack.xss,cve-2026-74999,</group>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this CVE is 0/4 — no patch artifact has been confirmed by any tracked source, and the vendor-fix and workaround fields are empty. Notably, the NVD description itself indicates that versions 1.6.18 and 1.7.x up to 1.7.3 are the first affected releases, implying that upstream fixed versions are 1.6.18 and 1.7.3. Organizations should verify the availability and integrity of these releases from official Roundcube channels before deploying.

1. Immediate mitigations:

   • Restrict or disable the "Add to address book" capability for low-privileged accounts where business workflows allow.
   • Deploy a web application firewall (WAF) rule set that blocks common XSS payload patterns (