Roundcube Webmail CVE-2026-48846

The target deployment must be running Roundcube Webmail 1.6.0-1.6.15 or 1.7.0 with HTML email rendering enabled. The remote image blocking feature must be configured as active - either enforced by administrator policy or enabled per-user - because this control is specifically what the CSS var() bypass circumvents; installations with remote image blocking disabled have no applicable security boundary to bypass. The attacker requires only the ability to send email to the target user (no account on the Roundcube instance is needed, consistent with PR:N in the CVSS vector). Exploitation is constrained by: the victim must open and render the crafted email in HTML mode within an active Roundcube session; the primary impact is information disclosure and access-control bypass, not code execution; and mass exploitation requires sending volume but no per-target reconnaissance.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a network-accessible, low-complexity flaw requiring no attacker authentication. However, the UI:N rating warrants scrutiny - viewing an email is technically required to trigger the CSS rendering, and some scoring frameworks would rate this UI:R; analysts should verify with the vendor whether additional victim interaction beyond passive email view is needed. EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' confirm no observed active exploitation. The SSVC 'Automatable: yes' rating is a meaningful risk amplifier: an attacker can automate sending crafted emails at scale to all reachable Roundcube users, making mass IP-harvesting and read-receipt campaigns mechanically trivial. The impact ceiling is limited (C:L/I:L - no remote code execution path indicated), so this is a real but bounded risk: prioritize patching internet-facing Roundcube instances, particularly in privacy-sensitive environments where IP disclosure or email-open tracking is a meaningful threat.

An attacker sends a specially crafted HTML email to a Roundcube Webmail user, where the message body contains a CSS style block or inline style using a var() reference that resolves to an attacker-controlled image URL. When the victim views the email in their Roundcube session with HTML rendering enabled, the browser processes the CSS var() at render time - after Roundcube's sanitizer has already passed the content - and silently fetches the external resource, delivering the victim's IP address, browser fingerprint, and precise read timestamp to the attacker's server. No public exploit code has been identified at time of analysis, but the technique is straightforward to construct given public knowledge of CSS custom property behavior.