Roundcube Webmail EUVD-2026-31728

Exploitation requires an authenticated Roundcube user account (confirmed by PR:L in the CVSS vector). The vulnerability is specifically triggered through the draft restore dialog, meaning the attacker must be able to save drafts to a mailbox folder accessible by a second user - i.e., a shared mailbox configuration is the primary enabling condition. The victim (second user) must interact with the draft restore dialog (UI:R), meaning passive viewing of the inbox alone does not trigger the XSS. High attack complexity (AC:H) further limits reliability, suggesting the conditions for a successful cross-user payload execution - shared mailbox configured, victim opening the specific draft restore UI - must align. Exploitation is limited to Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1; all other versions and non-shared-mailbox deployments are not confirmed affected by this specific issue.

The CVSS score of 4.4 (Medium) accurately reflects a constrained attack. The vector AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N imposes three significant exploitation hurdles: the attacker must be authenticated (PR:L), the attack complexity is high (AC:H, indicating non-trivial conditions must align), and a second user must interact with the draft restore dialog (UI:R). The Changed scope is notable for shared mailbox deployments, where a single malicious draft can affect multiple co-users. EPSS at 0.03% (10th percentile) is very low, consistent with the CISA SSVC determination of Exploitation: none and Automatable: no. The vulnerability is not in CISA KEV. Real-world priority is low for most single-user or private deployments but rises meaningfully for enterprise or hosting environments where shared mailboxes are in active use. The Tags field includes 'Suse', suggesting SUSE may issue a downstream advisory or package update, but no SUSE advisory URL is confirmed in the provided references.

An attacker with valid Roundcube credentials on an instance with shared mailbox access composes a draft message and injects a JavaScript or CSS payload (e.g., a cookie-stealing script or UI redress element) into the subject field, then saves it to a shared mailbox folder. When a co-user of that shared mailbox triggers the draft restore dialog - either deliberately or through normal draft management - the unsanitized subject content renders in their browser, executing the attacker's payload within their authenticated session context. No public exploit code is confirmed at time of analysis.