CVE-2026-114722

Overview

Roundcube Webmail versions prior to 1.6.20 and 1.7.5 are vulnerable to a CSS scoping bypass in HTML messages. The flaw allows an attacker to inject CSS that affects the entire application interface, enabling UI redressing and spoofing. This can mislead users into interacting with a malicious interface while using the legitimate webmail client.

Description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.

Impact

The vulnerability compromises the integrity of the user interface, allowing attackers to alter visual elements and potentially trick users into performing unintended actions. Confidentiality of email content is not directly affected, and availability is not impacted. End‑users and administrators of affected Roundcube installations are the primary stakeholders.

Remediation

Upgrade to Roundcube Webmail 1.6.20 or later, or 1.7.5 or later, where the CSS scoping issue is fixed. If an upgrade is not immediately possible, disable HTML email rendering or strip CSS from incoming messages via server‑side filtering. Additionally, enforce a strict Content Security Policy that limits inline styles and disallows external style sheets.

Risk context

The CVSS v3 score of 6.5 indicates a medium severity risk. With no EPSS data available, the urgency remains moderate; defenders should prioritize patching but can mitigate temporarily by disabling HTML rendering.

Affected products

• Roundcube Webmail 1.6.x
• Roundcube Webmail 1.7.x