Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 allow a mail header injection vulnerability that can be leveraged by a remote authenticated attacker. The implementation of the mail sending routine removes newline characters only from the Subject and Organization headers, leaving other header fields derived from request parameters unsanitized. An attacker can therefore inject arbitrary headers such as References, In-Reply-To, Message-ID, and From into the outbound message. This manipulation falls under CWE‑93 and CWE‑99 and could lead to unintended mail routing, forging of mail metadata or delivery to unintended recipients, compromising the integrity and possibly confidentiality of communications.

The affected product is Roundcube Webmail. The vulnerability impacts all installations running any version of Roundcube before 1.6.20 and any 1.7.x release before 1.7.5. Administrators of webmail services hosting these versions should verify the exact release they host and plan an update accordingly.

The CVSS score of 5 indicates moderate impact. The attack requires an authenticated user and does not need additional network privileges. The EPSS score signals a very low exploitation probability (< 1%). The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a legitimate user logging in, composing a new email, and manipulating the References, In-Reply-To, Message-ID, or From fields; the application injects those values into the outbound message without proper sanitization.