{"id":"CVE-2026-74999","published":"2026-08-17T12:42:51Z","modified":"2026-08-17T14:33:47Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the \"Add to address book\" action was subject to stored XSS","vendor":"Roundcube","product":"Webmail","tier":"tail","description":{"text":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the \"Add to address book\" action was subject to stored XSS.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00361,"percentile":0.29775,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.18","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/commit/32f20c6bfd12dff9cfb6880ae303e740f0804fe8","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.3","tags":[]},{"url":"https://github.com/roundcube/roundcubemail/commit/2d2a9604a820ee279c9ffcfe856b9b93a93995a8","tags":[]}],"priority":{"score":9.7,"factors":[{"name":"EPSS percentile","points":5.96},{"name":"CVSS severity","points":3.78}]},"vendorSlug":"roundcube","affectedVersions":[{"vendor":"Roundcube","product":"Webmail","versions":[">= 1.6.0, < 1.6.18",">= 1.7.0, < 1.7.3"]}],"euvd":{"id":"EUVD-2026-60166","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-roundcube-webmail-cwe-79"}}