EUVD-2026-18591
GHSA-xpqh-grpw-4xmg
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect resource transfer between spheres
|
| Impact | This vulnerability presents moderate real-world risk despite its modest CVSS score of 5.3. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network accessibility with low complexity and no authentication requirement, making exploitation trivial from an attacker perspective. However, the integrity impact is scoped to the user interface rather than system or data integrity-the attack requires user interaction (viewing a malicious email) and achieves only UI manipulation. No CVSS Availability impact is present. KEV status and active exploitation confirmation are not provided in the input data. The ENISA EUVD tag classification as 'Authentication Bypass' is technically a misnomer; this is CSS injection leading to UI bypass, not credential or authentication bypass. The primary risk vector is phishing or social engineering attacks leveraging email UI manipulation to deceive users into clicking malicious links or revealing sensitive information. The attack requires crafting a malicious HTML email and inducing a user to open it in Roundcube, making it less reliably automatable than network exploits despite the AC:L rating. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML email containing CSS rules with !important declarations designed to override Roundcube's fixed-position security overlays. When a victim opens this email in Roundcube Webmail, the malicious CSS renders a fake login form or warning dialog on top of the legitimate email content, deceiving the user into clicking a phishing link or submitting credentials. No special authentication is required-the attack succeeds against any user viewing HTML emails in a vulnerable Roundcube version, making it a practical phishing vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Roundcube Webmail before versions 1.5.14 and 1.6.14 allows unauthenticated remote attackers to bypass CSS-based security mitigations in HTML email rendering by injecting !important declarations, enabling potential integrity attacks such as phishing or UI redressing. The vulnerability stems from insufficient CSS sanitization when processing HTML email messages, with no authentication required and minimal attack complexity.
RemediationAI
Vendor-released patches are available for all affected versions: upgrade to Roundcube Webmail 1.5.14 or later in the 1.5.x branch, or 1.6.14 or later in the 1.6.x branch. The upstream fixes are documented in commits 57dec0c127b98e0c8e3b9c26c80049b9c4bcaea7 (1.5.14), 099009b9c8e1d3c636fb9a5af72f7c2596018662 (1.6.14), and 226811a1c974271dbedca72672923abaff8191c0 (1.7-rc5), all available via the official GitHub releases. Users unable to patch immediately should restrict HTML email rendering or disable HTML email display entirely, falling back to plaintext viewing until patches are applied. See the official advisory at https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 for detailed upgrade instructions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Roundcube Webmail is a browser-based IMAP email client that renders HTML email messages to users. The vulnerability exists in the CSS sanitization layer responsible for preventing malicious stylesheets in HTML emails from executing dangerous behavior. Modern email clients use fixed-position CSS overlays as a mitigation against phishing attacks-blocking users from interacting with sensitive UI elements beneath overlaid content. The attacker can circumvent these controls by using the !important CSS declaration, which has higher specificity and forces browser rendering to ignore the protective fixed-position rules. This is a CWE-669 (Inadequate Control Flow Management) class vulnerability, though more precisely it reflects improper input validation of CSS syntax during HTML email sanitization. The affected product is identified by CPE cpe:2.0:a:roundcube:webmail:*:*:*:*:*:*:*:* spanning versions 1.6.0 through 1.6.13 and all versions before 1.5.14.
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Roundcube Webmail Multiple Vulnerabilities
View all 8Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
Exploit-DB