Roundcube Webmail contained a flaw where the disabled_actions configuration could be circumvented. The program compared only the requested action name, ignoring the fact that many actions have deprecated aliases. Consequently, an authenticated user could trigger an action that should have been blocked, bypassing the intended restriction. This is an access control weakness (CWE-863) that could allow a user to perform functions they are not permitted to, potentially exposing sensitive data or altering settings. The vulnerability does not grant remote code execution and has a moderate CVSS score of 3.1, indicating a limited but real risk if exploited.

Roundcube Webmail installations using versions prior to 1.6.20 and any 1.7.x release older than 1.7.5 are impacted. Those missing the patched commit cannot enforce the disabled_actions check correctly when deprecated aliases are used.

The CVSS score of 3.1 reflects a low to moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a minimal current exploitation profile. The attack requires authentication, and the attacker must know or discover a deprecated alias for a disabled action. Once authenticated, the attacker can send a request using that alias to bypass the disabled action restriction. Because the flaw exploits an authorization check rather than a wide‑open vulnerability, the risk remains manageable with a timely patch.