CVE Catalog
CVE-2026-74999
MediumCVSS 5.4Summary
Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to stored XSS in the "Add to address book" action.
Risk Assessment
Risk of malicious script execution in user browsers, potentially leading to session theft or other attacks.
Recommendation
Upgrade Roundcube Webmail to 1.6.18 or 1.7.3 and educate users on safe address book usage.
Original NVD description (English source)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.