CVE-2026-75007

The LDAP filter substitution mechanism in Roundcube (versions prior to 1.6.18 and 1.7.3) contains an injection vulnerability that warrants more concern than the CVSS 5.4 suggests. The %u, %fu, and %d substitution patterns are explicitly designed to accept user input and splice it directly into directory queries—without escaping. This wasn't accidental string concatenation; it was intentional design that assumed upstream input was already sanitized. That assumption was never enforced as an explicit security contract, and it doesn't hold. The privilege escalation potential is the critical dimension the CVSS underweights. LDAP directories are identity backbones—they contain not just user records but service account credentials, trust relationships, group memberships granting access to critical systems, and password reset mechanisms. An attacker manipulating the search filter doesn't just extract what Roundcube's UI would normally show; they can enumerate administrators, identify accounts with domain-wide trust, and map delegation chains connecting the mail system to everything else. If Roundcube's LDAP integration uses a service account with elevated directory read access—common for address book solutions—that elevated context creates an asymmetric blast radius. The fix (1.6.18/1.7.3) adds proper escaping at the substitution point, which is correct but incomplete. It treats the symptom rather than the design question: whether user input should flow into query construction at all. Future developers inheriting this code will see 'escaping was added here' and may assume the threat is closed. The recurrence pattern in Roundcube's LDAP history (CVE-2020-12641, CVE-2020-13946) suggests the underlying abstraction design keeps producing new mutation points. Prioritize this patch if your Roundcube deployment uses LDAP address books or directory integration, particularly where that integration touches administrative or privileged directory accounts. The EPSS reflects narrow deployment prevalence, not reduced impact for the deployments that do exist.

Reviewed through automated stages and approved by a human before publication.