In Roundcube Webmail versions before 1.6.18 and before 1.7.3, an input validation flaw in the managesieve plugin allows a crafted Sieve rule name to be improperly quoted, which can bypass the managesieve_disabled_actions configuration setting. This flaw, classified as CWE‑77, means an attacker who can submit a Sieve script can potentially execute mailbox actions that the administrator intended to block, such as sending email or modifying folders. As a result, an authenticated user could elevate privileges within their own mailbox or exploit disabled features, leading to unintended data exposure or service disruption.

Affected software is Roundcube Webmail, specifically version 1.6.x prior to 1.6.18 and versions 1.7.x prior to 1.7.3. Only deployments that enable the managesieve plugin are vulnerable. The vulnerability exists regardless of the underlying mail server, as the issue resides in the Roundcube application layer that processes Sieve scripts sent to the managesieve plugin.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to submit a Sieve script, so it is limited to authenticated users with the managesieve plugin enabled. The likely attack vector is through a crafted rule name in a Sieve script, which an attacker could insert via a webmail interface. Operationally, once bypassed, malicious rule names can trigger privileged actions, potentially compromising mail confidentiality or integrity.