Users September 2026

users@lists.roundcube.net

5 participants
3 discussions

Re: Save password and username roundcube
by Jim Pazarena 27 Sep '26

27 Sep '26

On 2026-09-24 9:22 AM, silvano via Users wrote: > When I open my email via Roundcube webmail in Google Chrome, it won't > let me save my username and password. What should I do? Thanks. > switch to FireFox. Seriously tho, this is a Google Chrome issue ..... *not* Roundcube. -- Jim Pazarena roundcube(a)paz.bz Nanaimo - British Columbia - Canada

3 2

Save password and username roundcube
by posta＠silvanocurcio.it 24 Sep '26

24 Sep '26

When I open my email via Roundcube webmail in Google Chrome, it won't let me save my username and password. What should I do? Thanks.

1 0

[Roundcube Announce] Security updates 1.7.4 and 1.6.19 released
by Aleksander Machniak 06 Sep '26

06 Sep '26

We just published security updates to the 1.7 and 1.6 LTS versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities. Security fixes: - Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai - Fix CSS property injection via body `background` attribute, reported by zenithhostingevan - Fix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo - Fix email header injection via C-escape \r in the recipient display name, reported by dogeshark - Fix email header injection via identity's organization field, reported by dogeshark - Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko - Fix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers - Fix cross-user access in contact group membership (add/remove) in the SQL address book, reported by Joshua Rogers - Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL, reported by nept1337 - Fix remote content blocking bypass via CSS escapes in FuncIRI attributes, reported by neoxed - Fix remote-content blocker bypass via SVG SMIL src animation - Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy See the full changelogs in the release notes on the Github download pages for the updated versions. https://github.com/roundcube/roundcubemail/releases/tag/1.7.4 https://github.com/roundcube/roundcubemail/releases/tag/1.6.19 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions. -- Alec

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users September 2026