Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 have a flaw that allows a remote authenticated user to inject arbitrary IMAP commands. The vulnerability arises from accepting CRLF sequences in the _flag parameter of the mail/mark action, which the server forwards to the IMAP backend. If exploited, attackers can issue commands such as EXPUNGE, APPEND, or other mailbox manipulation commands, potentially deleting messages or altering mailbox state, thereby compromising data integrity and availability.

All deployments of Roundcube Webmail running the affected versions are impacted. This includes package builds and installations that have not been updated to Roundcube 1.6.20 or 1.7.5. Administrators should verify the installed version against the release notes for these fixes.

The CVSS score of 7.1 reflects high severity, while the EPSS score is not available, making the current risk level uncertain but potentially significant for environments with exposed Roundcube instances. The vulnerability is not listed in the CISA KEV catalog, however a remote authenticated attacker can exploit it via the webmail interface by submitting a specially crafted request that includes CRLF injections in the _flag field. No additional conditions beyond authentication are required, meaning any user with valid credentials to the webmail system could attempt the attack.