Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 allow a mail header injection vulnerability that can be leveraged by a remote authenticated attacker. The implementation of the mail sending routine removes newline characters only from the Subject and Organization headers, leaving other header fields derived from request parameters unsanitized. An attacker can therefore inject arbitrary headers such as References, In-Reply-To, Message-ID, and From into the outbound message. This manipulation falls under CWE‑99 and could lead to unintended mail routing, forging of mail metadata or delivery to unintended recipients, compromising the integrity and possibly confidentiality of communications.

The affected product is Roundcube Webmail. The vulnerability impacts all installations running any version of Roundcube prior to 1.6.20 and any 1.7.x release prior to 1.7.5. Administrators of webmail services running these versions should verify the exact release they host and plan an update accordingly.

The CVSS score indicates a moderate impact. The exploit requires the attacker to be authenticated on the target webmail instance, but no additional network privilege is needed. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a legitimate user logging in and composing a new email that includes manipulated values in the affected header fields, which the system then injects into the outgoing message without proper sanitisation.