What is the CVSS score of CVE-2026-35544?

CVE-2026-35544 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35544?

Yes, a patch is available for CVE-2026-35544. Update the affected software to the latest version immediately.

Webmail CVE-2026-35544

EUVD-2026-18591 MEDIUM

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-04-03 mitre

GHSA-xpqh-grpw-4xmg

Authentication Bypass Webmail

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 04, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 03, 2026 - 04:30 euvd

EUVD-2026-18591

Analysis Generated

Apr 03, 2026 - 04:30 vuln.today

CVE Published

Apr 03, 2026 - 03:59 nvd

MEDIUM 5.3

DescriptionCVE.org

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.

AnalysisAI

Roundcube Webmail before versions 1.5.14 and 1.6.14 allows unauthenticated remote attackers to bypass CSS-based security mitigations in HTML email rendering by injecting !important declarations, enabling potential integrity attacks such as phishing or UI redressing. The vulnerability stems from insufficient CSS sanitization when processing HTML email messages, with no authentication required and minimal attack complexity.

Technical ContextAI

Roundcube Webmail is a browser-based IMAP email client that renders HTML email messages to users. The vulnerability exists in the CSS sanitization layer responsible for preventing malicious stylesheets in HTML emails from executing dangerous behavior. Modern email clients use fixed-position CSS overlays as a mitigation against phishing attacks-blocking users from interacting with sensitive UI elements beneath overlaid content. The attacker can circumvent these controls by using the !important CSS declaration, which has higher specificity and forces browser rendering to ignore the protective fixed-position rules. This is a CWE-669 (Inadequate Control Flow Management) class vulnerability, though more precisely it reflects improper input validation of CSS syntax during HTML email sanitization. The affected product is identified by CPE cpe:2.0:a:roundcube:webmail:*:*:*:*:*:*:*:* spanning versions 1.6.0 through 1.6.13 and all versions before 1.5.14.

RemediationAI

Vendor-released patches are available for all affected versions: upgrade to Roundcube Webmail 1.5.14 or later in the 1.5.x branch, or 1.6.14 or later in the 1.6.x branch. The upstream fixes are documented in commits 57dec0c127b98e0c8e3b9c26c80049b9c4bcaea7 (1.5.14), 099009b9c8e1d3c636fb9a5af72f7c2596018662 (1.6.14), and 226811a1c974271dbedca72672923abaff8191c0 (1.7-rc5), all available via the official GitHub releases. Users unable to patch immediately should restrict HTML email rendering or disable HTML email display entirely, falling back to plaintext viewing until patches are applied. See the official advisory at https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 for detailed upgrade instructions.