Roundcube session desync (CVE-2026-114724): a '!' that turns into object injection

What happened

On 22 October 2026, CVE-2026-114724 was published for Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5. The flaw sits in rcube_session::unserialize(): a session key prefixed with ! was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value — desynchronizing the rest of the input so following session data was interpreted as a serialized value. The result is an object-injection primitive reachable through session data.

Roundcube has a grim track record here: previous session and XSS flaws (including the infamous CVE-2023-5631 and CVE-2024-42008 chains) were exploited by state actors against government mail. This one follows the same shape.

Impact

Object injection with a working gadget chain means webmail takeover: reading every mailbox on the host, harvesting password-reset emails for other services, and pivoting into password resets for admin panels. A compromised merchant mailbox routinely yields "forgot password" links for Magento admin, hosting, and payment dashboards.

Root cause in one paragraph

The session serializer and deserializer disagreed about what a !-prefixed key means; that single asymmetry shifted the parse frame so attacker-influenced bytes slid into a position the parser treated as a trusted serialized object.

What to do now

• Upgrade Roundcube to 1.6.20+ / 1.7.5+.
• Review webmail access logs for anomalous session payloads and unknown logins.
• Force password resets for mailboxes on the host and rotate any credentials that arrived by email.
• If webmail shares a host with the store, segment it — mail apps are high-exposure targets.
• Track Roundcube security announcements; its flaws get weaponized fast.

What this means for Magento stores

Order notifications, password resets, and 2FA backup codes all flow through email. If the mailbox itself is compromised, every "secure" reset flow built on top of it falls. Keep merchant mail on patched, isolated webmail — and prefer authenticator-app 2FA over email-delivered codes for Magento admin.

Sources

• NVD: CVE-2026-114724
• Roundcube release notes for 1.6.20 and 1.7.5

Next in this series: Node.js Brotli decoder RCE (CVE-2026-111497) — /blog/cve-2026-nodejs-brotli-111497