Roundcube Webmail CVE-2026-114722

Exploitation requires the target to use Roundcube Webmail (before 1.6.20, or 1.7.x before 1.7.5) with HTML message rendering enabled, which is the default. The attacker must be able to deliver an HTML email to the victim, and the specific trigger is an at-rule prologue such as '@layer a;' (or a selector beginning with '::') placed before CSS selectors so rcube_utils::mod_css_styles() fails to scope them to the message container. The primary limiting factor is that the victim must actually open/view the malicious HTML message, and impact is confined to visual UI redressing and spoofing - there is no direct code execution, data theft, or privilege change, so realized harm depends on the victim being socially engineered by the spoofed interface.

This is a moderate, bounded-impact issue rather than a top-priority emergency. The input CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5 (Medium) and models low-complexity, unauthenticated, network-delivered exploitation with low confidentiality and integrity impact and no availability impact. The vulnerability is a CSS scoping bypass enabling UI redressing/spoofing - it does not yield code execution, data exfiltration, or account takeover on its own, consistent with CWE-669 (incorporation of functionality from an untrusted control sphere). I disagree with the input UI:N: realistically the victim must open/view the malicious HTML message for the injected CSS to render against the application chrome, so an independent assessment should use UI:R (passive). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' Signals are largely consistent (low-complexity network vector, but impact confined to spoofing); the main conflict is the CVSS claiming UI:N while the attack inherently requires the victim to open an email - verify interaction requirement against the vendor advisory. Net: patch on a normal cadence, but this is not a widespread drive-by compromise risk.

An attacker sends a crafted HTML email to a Roundcube user containing CSS that uses an at-rule prologue (e.g. '@layer a;') or a selector beginning with '::' so that following selectors escape the message-body container and restyle the whole Roundcube interface. When the victim opens the message, the injected styles rewrite application chrome - hiding, moving, or overlaying UI elements - to spoof dialogs or trick the user into revealing information or taking unintended actions. No public exploit code is referenced, but the upstream fix commit and test cases publicly demonstrate the exact bypass payloads.