What is the CVSS score of CVE-2026-74998?

CVE-2026-74998 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Roundcube Webmail are affected by CVE-2026-74998?

Roundcube Webmail versions prior to 1.6.18 and 1.7.3 contain a vulnerability in CSS proxy handling that enables attackers to hijack user sessions and steal email data from authenticated webmail…. A patch is available.

How to fix or mitigate CVE-2026-74998?

Within 24 hours: audit all Roundcube installations to identify those running versions 1.6.x before 1.6.18 or 1.7.x before 1.7.3, and count affected users. Within 7 days: disable Roundcube's CSS proxy feature in configuration settings or enforce network firewall rules blocking external CSS access, then test and document any user-facing impact. Within 30 days: monitor official Roundcube releases for patches for versions 1.6.18, 1.7.3 or later; upon availability, test patches in staging, then deploy to production through a controlled rollout schedule.

Roundcube Webmail CVE-2026-74998

EUVD-2026-60165 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-17 mitre

GHSA-6pvc-73xq-46hq

Information Disclosure XSS Webmail Suse

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

UI:R because the victim must open a crafted email to trigger the CSS proxy fetch; Changed scope and C:L/I:L retained as XSS executes in the victim's browser session.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 17, 2026 - 14:15 EUVD

Source Code Evidence Fetched

Aug 17, 2026 - 13:28 vuln.today

Analysis Generated

Aug 17, 2026 - 13:28 vuln.today

CVE Published

Aug 17, 2026 - 12:40 cve.org

HIGH 7.2

DescriptionCVE.org

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.

AnalysisAI

Roundcube Webmail's built-in CSS proxy failed to validate responses from external CSS sources, enabling XSS or information disclosure via browser MIME sniffing in versions before 1.6.18 and 1.7.x before 1.7.3. The CVSS 3.1 score of 7.2 with Changed scope reflects that successful exploitation compromises the victim's browser session within the webmail origin. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Attacker sends HTML email with link to malicious CSS server

Delivery

Victim opens email in Roundcube

Exploit

CSS proxy fetches attacker-controlled CSS resource

Install

Attacker server returns script payload with missing or misleading Content-Type

Browser MIME-sniffs response as executable content

Execute

JavaScript executes in Roundcube webmail origin

Impact

Session tokens or email data exfiltrated

Recon

Attacker sends HTML email with link to malicious CSS server

Delivery

Victim opens email in Roundcube

Exploit

CSS proxy fetches attacker-controlled CSS resource

Install

Attacker server returns script payload with missing or misleading Content-Type

Browser MIME-sniffs response as executable content

Execute

JavaScript executes in Roundcube webmail origin

Impact

Session tokens or email data exfiltrated

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target Roundcube instance to have its CSS proxy active, which is standard behavior for HTML email rendering and not a non-default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a network-exploitable, low-complexity path with no privilege requirement and Changed scope, consistent with XSS executing in a victim's browser session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a crafted HTML email to a Roundcube user, embedding a link to an attacker-controlled external CSS resource. When the victim opens or previews the email, Roundcube's CSS proxy fetches the resource; the attacker's server returns payload content without a valid Content-Type header, causing the victim's browser to MIME-sniff it as executable script running in the Roundcube webmail origin, potentially stealing session tokens or reading email content. …
Remediation	The primary remediation is upgrading to Roundcube Webmail 1.6.18 for 1.6.x deployments or 1.7.3 for 1.7.x deployments; both are confirmed releases available at https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 respectively, with vendor guidance at https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: audit all Roundcube installations to identify those running versions 1.6.x before 1.6.18 or 1.7.x before 1.7.3, and count affected users. …

Threat intelligence, references, and detailed analysis are available after sign-in.