CVE-2026-114722 in Roundcube
Summary
by MITRE • 10/23/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified as a CSS scoping bypass in Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 represents a significant security flaw within the application's email rendering engine. This issue stems from an inadequacy in how the rcube_utils::mod_css_styles function processes Cascading Style Sheets embedded within incoming HTML messages. In modern web applications, particularly those handling untrusted content like email clients, it is critical to isolate user-provided styles from the application’s own interface stylesheets to prevent malicious actors from altering the visual presentation of the software itself. The core technical flaw lies in the parser's failure to recognize specific CSS at-rule prologues, such as @layer a;, as valid boundaries for scoping selectors. Additionally, the function failed to properly handle selectors that begin with double colons, which denote pseudo-elements. Consequently, any CSS rules defined after these unhandled constructs were not confined to the message body container but instead leaked into the global scope of the Roundcube interface.
This lack of proper isolation allows an attacker who sends a crafted HTML email to inject stylesheets that override or modify the styling of Roundcube's user interface elements. By restyling application chrome, such as buttons, menus, and navigation bars, the vulnerability enables UI redressing attacks. In this context, an adversary can manipulate the visual appearance of critical interactive components to deceive users into performing unintended actions. For instance, a malicious email could make a benign action button appear as a sensitive administrative control or disguise a phishing link within a seemingly legitimate interface element. This capability directly facilitates spoofing and social engineering campaigns where the trustworthiness of the Roundcube environment is exploited to trick recipients into revealing credentials, clicking on malicious links, or executing other harmful operations under false pretenses.
From an industry standard perspective, this vulnerability aligns with CWE-79, which describes Cross-site Scripting (XSS), specifically in its manifestation as DOM-based XSS where untrusted data influences the rendering of a web page without proper sanitization. Furthermore, it maps to CWE-1021, Improper Restriction of Rendered UI Layers or Frames, because the attacker successfully breaks out of the intended sandbox of the email body and affects the surrounding application layer. In terms of offensive security frameworks, this flaw supports techniques found in MITRE ATT&CK Tactic TA0005 (Defense Evasion) under sub-technique T1623, specifically using iframe or HTML embedding to bypass restrictions, although more accurately it falls under UI Redressing which is often associated with social engineering tactics like T1598. The ability to restyle the interface is a precursor to more direct phishing attacks and undermines the integrity of the user experience by introducing visual inconsistencies that can be leveraged for deception.
To mitigate this vulnerability, organizations running Roundcube Webmail must upgrade immediately to version 1.6.20 or later if on the stable branch, or version 1.7.5 and above if using the development branch. The upstream fix addresses the issue by ensuring that at-rule prologues are correctly identified as selector boundaries and that pseudo-element selectors are handled appropriately within the scoping logic of the CSS processing function. Until an upgrade is feasible, administrators should consider implementing strict Content Security Policy headers to restrict inline styles where possible, although this may impact legitimate email functionality. Additionally, deploying web application firewalls with rules capable of detecting anomalous CSS injection patterns in HTTP POST requests containing HTML content can provide a layer of defense against exploitation attempts. Regular security audits and code reviews focusing on the sanitization of user-supplied style data are recommended to prevent similar scoping bypasses in future updates or custom modifications to the Roundcube core.