CVE-2026-114722
Description
A flaw was found in Roundcube Webmail. When rendering incoming HTML messages, the application fails to properly confine Cascading Style Sheets (CSS) styling rules to the email body. A remote attacker can exploit this issue by sending a specially crafted email that alters the surrounding webmail interface. Successful exploitation allows an attacker to conduct user interface (UI) redressing and phishing attacks by spoofing elements of the application.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires a recipient to open a crafted email message and is limited to visual interface redressing rather than arbitrary code execution or credential theft. While attackers can manipulate styles outside the email display area to mislead users, the underlying server integrity remains unaffected. Furthermore, roundcubemail is not included in supported Red Hat Enterprise Linux releases and is maintained only in community distributions like EPEL and Fedora.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism; Read Application Data; Modify Application Data
An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trick the user into changing privacy settings.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
