Live › vulnerability › CVE-2026-114722
Go to dashboardRoundcube did not confine CSS inside HTML emails to the message body when the CSS used an at-rule such as @layer or selectors starting with ::. A malicious message can therefore restyle Roundcube's own interface, enabling UI redressing and spoofing of login or action prompts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Roundcube Webmail instance before 1.6.20 or in the 1.7.x line before 1.7.5 that renders HTML email, which is the default for users reading mail in the browser. Attackers only need to send a message to a user of the affected instance, so mail server operators and webmail administrators should patch. Instances that have already been upgraded, or that show only plain-text mail, are not exposed.
No product ranges from the sources yet.
program/include/iniset.php (RCMAIL_VERSION), and compare it with the fixed versions below.1.6.20 or later on the 1.6 branch, or to 1.7.5 or later on the 1.7 branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.
This page as .md · .json · in your agent: get_signal("CVE-2026-114722")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.