What is the CVSS score of CVE-2026-48846?

CVE-2026-48846 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48846?

Yes, a patch is available for CVE-2026-48846. Update the affected software to the latest version immediately.

Roundcube Webmail CVE-2026-48846

EUVD-2026-31725 MEDIUM

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-05-25 mitre

GHSA-xx87-33v7-6x23

Information Disclosure Webmail

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 12:43 vuln.today

Analysis Generated

Jun 08, 2026 - 12:43 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

AnalysisAI

Remote image blocking in Roundcube Webmail 1.6.x and 1.7.x can be silently bypassed by embedding a crafted CSS var() expression in an HTML email, causing the victim's browser to fetch attacker-controlled external resources despite the privacy control being active. This leads to information disclosure - including IP address leakage and email-open tracking - and potential access-control bypass. No public exploit has been identified at time of analysis and EPSS is very low (0.03%), but SSVC rates this 'Automatable: yes,' making mass-scale email tracking campaigns feasible against unpatched Roundcube deployments.

Technical ContextAI

Roundcube Webmail's HTML sanitizer enforces a 'block remote images' control designed to prevent tracking pixels and IP address disclosure when users view HTML email. CWE-669 (Incorrect Resource Transfer Between Spheres) identifies the root cause: content from the untrusted email sphere (CSS var() declarations) was permitted to influence the trusted browser rendering sphere by indirectly resolving to external URLs that bypassed the image-blocking filter. CSS custom properties (var()) are a CSS feature allowing values set in one context to be referenced by name in another; the sanitizer failed to resolve or restrict these indirections at parse time, so the browser performed the external fetch at render time after sanitizer checks were complete. Affected CPE is cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* covering the 1.6.0-1.6.15 and 1.7.0 version ranges. Fix commits are 59cca80908a61e662c5f81741449e9aeb91e8abe (1.7 branch) and 852350486b88b35b8544e8a630fad89e99e2150a (1.6 branch).

RemediationAI

Upgrade to Roundcube Webmail 1.6.16 or 1.7.1, released 2026-05-24, per the vendor advisory at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1. Tagged releases are available at https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.1. The vendor recommends backing up data before updating. SUSE Linux administrators should monitor distribution package repositories for updated roundcubemail packages. As a compensating control prior to patching, administrators can enforce plain-text-only email rendering at the server level, which eliminates CSS processing entirely and removes the attack surface - but at the cost of HTML email functionality for all users, which is not suitable for most deployments. There is no known configuration toggle to disable CSS var() processing independently of full HTML rendering.