What is the CVSS score of CVE-2026-48845?

CVE-2026-48845 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48845?

Yes, a patch is available for CVE-2026-48845. Update the affected software to the latest version immediately.

Roundcube Webmail CVE-2026-48845

EUVD-2026-31720 MEDIUM

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-05-25 mitre

GHSA-g4h2-2gp2-j3wq

Information Disclosure Privilege Escalation Webmail

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 11:30 vuln.today

Analysis Generated

Jun 08, 2026 - 11:30 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.

AnalysisAI

Remote image blocking bypass in Roundcube Webmail allows unauthenticated network attackers to embed HTML email image tags pointing to local or private network destinations, causing the server to fetch those resources despite the 'block remote images' policy being active. Affected versions are 1.6.14 through 1.6.15 and 1.7.0, with vendor-released patches 1.6.16 and 1.7.1 available since May 2026 per the official advisory. No public exploit has been identified at time of analysis and EPSS is very low at 0.03%, though SSVC rates technical impact as total - a notable discrepancy that warrants attention for deployments where the mail server has internal network access.

Technical ContextAI

The root cause is CWE-669 (Incorrect Resource Transfer Between Spheres), which describes a failure to enforce trust-zone boundaries between the public internet and local or private network ranges. Roundcube Webmail's remote image blocking feature is designed to prevent server-side fetches of external URLs embedded in HTML email bodies, protecting against tracking pixels and server-side request forgery. The bypass occurs because URL validation logic fails to classify addresses in RFC 1918 ranges (10.x, 172.16.x, 192.168.x), loopback (127.x), and link-local ranges (169.254.x) as restricted destinations requiring blocking. The affected CPE is cpe:2.3:a:roundcube:webmail across the 1.6.14-1.6.16 and 1.7.0 ranges. The fix is present in commits d82b8c6cd06c378eca6d647ccd548f4ff1c68659 (1.7.1) and 7b52353653a67e6073b97d70eb94047132b78556 (1.6.16), and was reported by the Orange Cyberdefense Vulnerability Disclosure Team as confirmed in the 1.7.1 release notes.

RemediationAI

The primary fix is upgrading to Roundcube Webmail 1.7.1 for 1.7.x deployments, or 1.6.16 for 1.6.x deployments, per the vendor security advisory at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1. Vendor-released patches are confirmed at these exact versions. If immediate patching is not feasible, enforce network-level egress filtering on the Roundcube server host to block outbound connections to RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local ranges (169.254.0.0/16) - note this may break legitimate intranet mail integrations if any exist. Disabling HTML email rendering entirely eliminates the attack surface but severely degrades usability. For cloud-hosted deployments, restricting access to the instance metadata endpoint (169.254.169.254) via host firewall rules is a high-priority specific control given SSVC's total technical impact rating. SUSE users should monitor distribution channels for updated packages.