---
id: "CVE-2026-114722"
kind: "vulnerability"
aliases: ["CVE-2026-114722"]
title: "Roundcube Webmail: crafted HTML email restyles the whole interface"
severity: "medium"
cvss: 6.5
epss: 0.00252
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email", "package", "roundcube", "self-hosted", "webmail"]
not_affected_if: ["default-config"]
published_at: "2026-10-22T02:17:00+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:48:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114722", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114722", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Roundcube Webmail: crafted HTML email restyles the whole interface

Roundcube did not confine CSS inside HTML emails to the message body when the CSS used an at-rule such as @layer or selectors starting with ::. A malicious message can therefore restyle Roundcube's own interface, enabling UI redressing and spoofing of login or action prompts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Roundcube version in the footer, or in `program/include/iniset.php` (`RCMAIL_VERSION`), and compare it with the fixed versions below.
- Confirm whether HTML message rendering is enabled for users (default in Roundcube).

## Fix

- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6 branch, or to `1.7.5` or later on the 1.7 branch.
- Upstream fix: commit "Fix CSS scoping bypass in HTML messages using at-rules".

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114722
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114722

## From the sources

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_