What is the CVSS score of EUVD-2026-18587?

EUVD-2026-18587 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-18587?

Yes, a patch is available for EUVD-2026-18587. Update the affected software to the latest version immediately.

Webmail EUVD-2026-18587

| CVE-2026-35542 MEDIUM

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-04-03 mitre

GHSA-5hf6-crg4-fg59

Information Disclosure Webmail

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 04, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 03, 2026 - 04:30 euvd

EUVD-2026-18587

Analysis Generated

Apr 03, 2026 - 04:30 vuln.today

CVE Published

Apr 03, 2026 - 03:54 nvd

MEDIUM 5.3

DescriptionCVE.org

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.

AnalysisAI

Roundcube Webmail before versions 1.5.14 and 1.6.14 allows unauthenticated remote attackers to bypass the remote image blocking security feature through a crafted background attribute in a BODY element of an email message, enabling information disclosure via tracking pixels or other image-based reconnaissance. The vulnerability affects all versions prior to 1.5.14 and 1.6.x versions before 1.6.14, with CVSS 5.3 (medium severity) reflecting the low confidentiality impact but lack of authentication requirements.

Technical ContextAI

Roundcube Webmail implements a remote image blocking feature as a privacy protection mechanism to prevent email senders from using image requests to track when messages are read or to identify valid email addresses. The vulnerability exploits improper input sanitization of HTML attributes within email messages, specifically the BACKGROUND attribute of the BODY element (CWE-669: Improper Neutralization of Input During Web Page Generation). When an attacker crafts an email with a malicious BACKGROUND attribute, the filtering logic fails to properly block the resulting image request, allowing the remote server to be contacted regardless of the user's privacy settings. This affects the web-based email client running on affected Roundcube installations (CPE: cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*), which processes untrusted HTML from incoming email messages.

RemediationAI

Vendor-released patches are available: upgrade Roundcube Webmail to version 1.5.14 or later for the 1.5.x branch, version 1.6.14 or later for the 1.6.x branch, or 1.7-rc5 or later for the development branch. Administrators should apply patches immediately through their standard package management or by downloading the latest releases from https://github.com/roundcube/roundcubemail/releases/. No workarounds are documented; patch deployment is the only remediation. For organizations unable to immediately update, temporary mitigation could include disabling the remote image blocking feature and warning users about email tracking risks, though this is not a substitute for patching.