{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-05-28T16:35:38.661Z",
        "orgId": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd",
        "shortName": "OCD"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd",
    "assignerShortName": "OCD",
    "cveId": "CVE-2026-9818",
    "datePublished": "2026-05-28T12:16:05.464Z",
    "dateRejected": "2026-05-28T16:35:38.661Z",
    "dateReserved": "2026-05-28T10:37:45.625Z",
    "dateUpdated": "2026-05-28T16:35:38.661Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-9818\",\"sourceIdentifier\":\"6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd\",\"published\":\"2026-05-28T13:16:25.440\",\"lastModified\":\"2026-05-28T17:16:36.090\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-9818\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-28T13:24:10.638627Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-28T13:24:14.064Z\"}}], \"cna\": {\"title\": \"Roundcube Local/Private URL Fetch Bypass\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Guillaume Meunier from Orange Cyberdefense CERT VOC Team\"}], \"impacts\": [{\"capecId\": \"CAPEC-554\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-554 Functionality Bypass\"}]}, {\"capecId\": \"CAPEC-664\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-664 Server Side Request Forgery\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/roundcube/roundcubemail/\", \"vendor\": \"Roundcube\", \"product\": \"Webmail\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"1.6.16\", \"status\": \"unaffected\"}], \"version\": \"0\", \"lessThan\": \"1.6.16\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"1.7.1\", \"status\": \"unaffected\"}], \"version\": \"1.7.0\", \"lessThan\": \"1.7.1\", \"versionType\": \"git\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to Roundcube Webmail 1.6.16 or 1.7.1\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Upgrade to Roundcube Webmail 1.6.16 or 1.7.1\", \"base64\": false}]}], \"datePublic\": \"2026-05-28T10:58:00.000Z\", \"references\": [{\"url\": \"https://github.com/roundcube/roundcubemail/releases/tag/1.7.1\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/roundcube/roundcubemail/releases/tag/1.6.16\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/roundcube/roundcubemail/commit/faf867432f51ebbe100382a70a9e3c042415ee1b\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/roundcube/roundcubemail/commit/7b52353653a67e6073b97d70eb94047132b78556\", \"tags\": [\"patch\"]}, {\"url\": \"https://advisories.orangecyberdefense.com/advisories/163\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Roundcube\u0027s HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim\u0027s browser to issue requests to local or private-network services simply by opening the message preview.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Roundcube\u0027s HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim\u0027s browser to issue requests to local or private-network services simply by opening the message preview.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-184\", \"description\": \"CWE-184 Incomplete list of disallowed inputs\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.6.16\", \"versionStartIncluding\": \"0\"}, {\"criteria\": \"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.7.1\", \"versionStartIncluding\": \"1.7.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd\", \"shortName\": \"OCD\", \"dateUpdated\": \"2026-05-28T12:16:05.464Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-9818\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-28T13:24:17.678Z\", \"dateReserved\": \"2026-05-28T10:37:45.625Z\", \"assignerOrgId\": \"6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd\", \"datePublished\": \"2026-05-28T12:16:05.464Z\", \"assignerShortName\": \"OCD\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}