CVE-2026-75007

Executive Summary

CVE-2026-75007 is an LDAP search filter injection vulnerability in Roundcube Webmail prior to 1.6.18 and in the 1.7.x branch prior to 1.7.3. An authenticated attacker who can control the username, full username, or domain values used by the webmail application can inject LDAP filter syntax because the %u, %fu, and %d substitution tokens are not escaped before being embedded in LDAP directory queries. Successful exploitation may result in information disclosure of directory content or privilege escalation, with a base CVSS score of 5.4 (Medium). Organizations operating Roundcube instances with LDAP-backed address books are the primary affected population.

Technical Analysis

The vulnerability resides in how Roundcube Webmail constructs LDAP search filters for its directory/address book integration. LDAP filters follow RFC 4515 syntax, where characters such as (, ), *, |, &, !, =, <, >, and ~ carry query semantics. When user-supplied identity components are concatenated into a filter string without proper escaping, the resulting filter is no longer a literal equality/contains match; an attacker can restructure the query to widen the result set, add OR/AND branches, or wildcard-match unintended directory objects.

The NVD description identifies the injection vector as "unescaped %u/%fu/%d substitution":

• %u — the authenticated username.
• %fu — the full username (typically user@domain).
• %d — the domain portion of the identity.

These placeholders are substituted at runtime into the administrator-defined LDAP search filter (for example, an address book query such as (mail=%fu)). If an attacker registers or authenticates with a crafted username containing LDAP metacharacters (e.g., *, )(|), the substituted filter changes meaning. The flaw is classified under CWE-77 (improper neutralization of special elements used in a command); while the assigned CWE ID is CWE-77, the concrete sink is an LDAP directory query built from user-influenced values.

Because the CVSS vector requires only low privileges (PR:L) and no user interaction (UI:N), any authenticated mailbox user with the ability to set or influence the identity fields that reach the LDAP substitution point is a potential attacker. The attack is network-reachable (AV:N), and the confidentiality and integrity impacts are each rated Low. No availability impact is reported (A:N), and the scope remains unchanged (S:U), meaning the injected query cannot cross a security trust boundary beyond the LDAP data accessible to the directory bind account.

Specific code-level detail — exact functions, file paths, or classes — is not present in the NVD description or CNA title provided. The analysis above is therefore grounded in the documented substitution tokens, the affected version ranges, and the generic LDAP injection mechanism. Insufficient technical detail is available to enumerate the precise code path without speculation.

Exploitation Scenarios

No public PoC is available and exploit code has not been observed in the wild; the attack chain below is inferred from the vulnerability class described in the NVD data.

1. Reconnaissance / target identification. An attacker identifies a Roundcube Webmail instance through HTTP banner or login-page fingerprinting (default page title "Roundcube Webmail", favicon, or known asset discovery). The attacker then determines whether the deployment integrates an LDAP directory (e.g., observed corporate single sign-on, directory-backed contacts, or address book autocomplete behavior). A valid low-privileged mailbox account is obtained through legitimate registration, credential reuse, or previously compromised credentials.

2. Triggering the flaw. The attacker authenticates (or otherwise causes Roundcube to process their identity) using a username, full username, or domain value that embeds LDAP filter metacharacters — for example, values containing *, )(|, )(&, or parenthesized OR/AND branches. When Roundcube substitutes the %u, %fu, or %d tokens into the LDAP search filter, the crafted characters alter the filter's structure rather than being treated as literal data.

3. Payload / execution. At the class level, the injected filter changes the LDAP query semantics on the back-end directory server. Typical payloads close an existing filter branch and append additional conditions — for instance, broadening a user-scoped equality filter into a wildcard or OR-based query that returns multiple directory objects, or injecting a condition that bypasses intended access boundaries. The LDAP server processes the modified filter as a legitimate query originating from the Roundcube service account.

4. Post-exploitation impact. The directory results are rendered back through the address book/search interface. An attacker can enumerate user accounts, mail attributes, group memberships, and other attributes exposed by the LDAP schema and the address book configuration. If subsequent authorization decisions (e.g., group membership checks, administrative role lookups) rely on the affected LDAP query results, the injection may lead to privilege escalation within the webmail application or the wider identity infrastructure. Disclosed directory data can also feed targeted phishing, credential attacks, or lateral movement.

Impact Assessment

The vulnerability is rated Medium with a CVSS base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The vector communicates several important operational facts:

• Network vector, low complexity: exploitation does not require special conditions beyond reaching the webmail service.
• Low privileges required: an existing authenticated account is sufficient; no administrator role is needed.
• No user interaction: no victim action is required for the attack to succeed.
• Low confidentiality and low integrity impact: the attacker gains limited but meaningful access to LDAP directory data and can influence query results, with no direct availability impact.

For enterprise environments, the practical blast radius depends on two variables: (1) whether the Roundcube deployment uses LDAP address books with %u/%fu/%d in the search filter, and (2) which attributes the directory bind account and address book schema expose. A default deployment that does not use LDAP substitution is not exposed to this specific flaw. Where LDAP integration is present, any tenant user can attack the directory query path, making multi-tenant or shared webmail installations particularly sensitive. Disclosure of internal directory structure (usernames, mail attributes, group memberships) is a realistic precursor to further account compromise and violates common data-protection expectations, even if the technical rating is Medium.

Detection Guidance

The following detection content targets the observable artifacts of LDAP injection attempts: HTTP requests whose URIs or bodies contain LDAP filter metacharacter sequences, and web/access-log entries showing such payloads. Rules are generic and should be tuned to local Roundcube paths and log field names.

Sigma Rule

title: Potential LDAP Injection in Roundcube Webmail (CVE-2026-75007)
id: 7f3a9c2e-6d8b-4a5f-9c1e-2b7d0a4f8e31
status: experimental
description: >
  Detects HTTP requests containing LDAP filter injection patterns consistent with
  unescaped %u/%fu/%d substitution in Roundcube Webmail before 1.6.18 and 1.7.x
  before 1.7.3.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75007
author: valtersit.com Threat Intelligence
date: 2025/06/01
logsource:
    category: webserver
    product: generic
detection:
    selection_uri_encoded:
        http.request.uri|contains:
            - '%28'          # (
            - '%29'          # )
            - '%7C'          # |
            - '%26'          # &
            - '%2A'          # *
    selection_uri_raw:
        http.request.uri|contains:
            - ')(|'
            - ')(&'
            - '(|('
            - '(&('
            - '*)(uid='
            - '*)(mail='
    selection_body:
        http.request.body|contains:
            - ')(|'
            - ')(&'
            - '(|('
            - '(&('
            - '*)(uid='
            - '*)(mail='
    condition: selection_uri_encoded or selection_uri_raw or selection_body
falsepositives:
    - Very unlikely in normal webmail usage; LDAP metacharacter sequences in user-supplied
      identity fields are not produced by standard clients.
level: high

YARA Rule

rule CVE_2026_75007_Roundcube_LDAP_Injection
{
    meta:
        author      = "valtersit.com Threat Intelligence"
        description = "Detects LDAP filter injection patterns targeting Roundcube Webmail %u/%fu/%d substitution in web logs and captured payloads"
        cve         = "2026-75007"
        date        = "2025-06-01"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-75007"
    strings:
        $s_raw_or     = ")(|" ascii
        $s_raw_and    = ")(&" ascii
        $s_or_open    = "(|(" ascii
        $s_and_open   = "(&(" ascii
        $s_uid_wild   = "*)(uid=" ascii
        $s_mail_wild  = "*)(mail=" ascii
        $s_enc_round  = "%28%29" ascii
        $s_enc_pipe   = "%7C" ascii
        $s_enc_amp    = "%26" ascii
        $s_enc_star   = "%2A" ascii
    condition:
        filesize < 10MB and
        (
            2 of ($s_raw_or, $s_raw_and, $s_or_open, $s_and_open, $s_uid_wild, $s_mail_wild)
            or
            (any of ($s_enc_round, $s_enc_pipe, $s_enc_amp) and any of ($s_enc_star, $s_uid_wild, $s_mail_wild))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75007 Potential LDAP Injection in Roundcube Webmail"; flow:established,to_server; http.uri; pcre:"/(?:%28|%29|%7C|%26|%2A|\)\||\)\(\&|\(\|\(|\(\&\(|\*\)\((?:uid|mail)=)/i"; classtype:attempted-admin; reference:cve,2026-75007; sid:202675007; rev:1;)

Elastic Detection

// Detect LDAP injection patterns in HTTP requests (EQL)
network where event.category == "web" and
  (
    wildcard(http.request.uri, "*%28*", "*%29*", "*%7C*", "*%26*", "*%2A*") or
    wildcard(http.request.uri, "*)(|*", "*)(&*", "*(|(*", "*&(*") or
    wildcard(http.request.body, "*)(|*", "*)(&*", "*(|(*", "*&(*")
  )

Splunk SPL Query

index=web sourcetype=access_* 
  | regex uri_query="(?i)(%28|%29|%7c|%26|%2a|\)\(|\(\||\(&|\*\)\((uid|mail)=)"
  | table _time src_ip user uri_path uri_query status
  | sort - _time

index=web sourcetype=access_* 
  | regex form_data="(?i)(\)\(\||\)\(\&|\(\|\(|\(\&\(|\*\)\((uid|mail)=)"
  | table _time src_ip user uri_path form_data status
  | sort - _time

Wazuh OSSEC Rule

<group name="web_ldap_injection,">
  <rule id="100007" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex>(\|\(|\(&amp;\(|\)\(|\*\)\((uid|mail)=|%28|%29|%7c|%26)</regex>
    <description>CVE-2026-75007 - Possible LDAP injection in Roundcube Webmail request (%u/%fu/%d substitution)</description>
    <group>web_ldap_injection,webmail,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found in any tracked source; vendor advisory and fix commits were not confirmed in the provided data. Note that the NVD description itself references 1.6.18 and 1.7.3 as the first unaffected releases, which strongly implies upstream fixes exist in those versions. Administrators should verify release availability from the Roundcube project before acting.

1. Immediate mitigations (if patch cannot be confirmed/installed):

   • Disable or restrict LDAP address book features in Roundcube configuration until the affected instances are upgraded.
   • Apply strict input validation on authentication/identity fields: reject usernames, full usernames, and domains containing LDAP metacharacters (( ) * | & ! = < > ~).
   • Deploy WAF or proxy rules matching the LDAP injection patterns above (URL-encoded and raw forms) against webmail endpoints.
   • Restrict access to Roundcube to authenticated VPN/SSO segments, reducing external exposure of the attack surface.
   • Limit the LDAP bind account to read-only privileges with a narrowly scoped search base, minimizing data exposure if injection succeeds.

2. Patch / upgrade steps:

   • Confirm with the Roundcube project whether 1.6.18 and 1.7.3 are released and contain the fix for this issue.
   • Upgrade affected instances to Roundcube 1.6.18+ or 1.7.3+ in a staging environment first.
   • Test LDAP address book behavior and filter substitution after upgrade; verify no regression in normal directory search.

3. Long-term hardening:

   • Enforce least privilege for all mailbox accounts and for any service account used to bind to LDAP.
   • Sanitize or encode %u/%fu/%d substitution values before filter construction in any future/adjacent code paths.
   • Maintain a documented, monitored inventory of Roundcube versions and LDAP integrations.
   • Enable logging of LDAP queries on the directory server and correlate anomalous filter structures with webmail activity.
   • Subscribe to Roundcube security advisories and the CISA Known Exploited Vulnerabilities catalog (CVE-2026-75007 is currently NOT listed in KEV).

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75007
• MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-75007
• Roundcube Project Release Announcements: https://roundcube.net/news/ (verify 1.6.18 and 1.7.3 release notes)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS: not yet scored by FIRST.org — no EPSS value is available at this time

No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-75007 was identified in the provided data; CISA KEV status is NO.