Roundcube Webmail CVE-2026-75000

The victim must open or preview a malicious email within a Roundcube Webmail instance running any version prior to 1.6.18 or 1.7.3. No authentication, privileges, or account access is required on the attacker's side - delivering an email to any inbox served by the vulnerable instance is sufficient. HTML rendering mode must be active, which is the default configuration; installations explicitly configured to display only plain text are not affected by this specific bypass. The attack specifically defeats Roundcube's built-in remote image and content blocking control; deployments that enforce external resource blocking at an additional layer (proxy, network egress filter) may limit the information disclosure impact even on unpatched instances. Exploitation is bounded in direct impact to passive metadata collection unless a secondary escalation mechanism exists in the specific deployment, which remains unconfirmed in available data.

The CVSS 5.8 score with Scope:Changed (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) reflects that the attack boundary extends beyond the webmail application itself, but the confidentiality impact is rated Limited - primarily user IP address, email-open event, and client fingerprint exposure rather than session or credential compromise. The privilege escalation pathway asserted in the description is not mechanistically explained in available data and must be treated as reported-but-unconfirmed; defenders should note this ambiguity when assessing worst-case impact. No EPSS score was present in the provided intelligence, and neither a CISA KEV listing nor public proof-of-concept code has been identified, indicating this is not currently subject to mass exploitation. The official CVSS vector assigns UI:N, which this analysis disputes - viewing an email constitutes user interaction, making UI:R more accurate and marginally lowering the exploitability score. Despite limited individual impact, the zero-prerequisite attacker path and broad Roundcube deployment base mean that even a mid-sized municipal IT team in gniezno running an unpatched instance would silently expose all webmail users to passive tracking through normal email use. Deployments relying on Roundcube's built-in content blocking as their sole external-resource defense face the highest residual risk.

An attacker authors a malicious HTML email embedding an SVG element whose animate by attribute references an attacker-controlled URL, then delivers it to any mailbox served by a vulnerable Roundcube instance. When the victim opens or previews the message, Roundcube's sanitizer passes the attribute through unchecked, causing the webmail client to silently fetch the external resource and disclosing the victim's IP address, read timestamp, and browser fingerprint to the attacker. No public proof-of-concept has been identified, though the technique requires only basic SVG authoring knowledge and standard email delivery.