CVE-2026-114728
Description
A flaw was found in Roundcube Webmail. The HTML message sanitizer fails to properly normalize all valid CSS escape sequences when inspecting external resource attributes. A remote attacker can exploit this flaw by sending a crafted email that bypasses remote content blocking, causing external content to load automatically without user consent and resulting in information disclosure.
Statement
This flaw is rated as Moderate severity rather than Important because successful exploitation is confined to unauthorized retrieval of external web resources, resulting in limited information exposure without code execution or database compromise. In standard Red Hat Enterprise Linux environments, Roundcube Webmail is not distributed as a supported core product and is only packaged through community repositories such as EPEL. The issue occurs when the webmail sanitizer fails to process obfuscated styling tokens, which allows incoming messages to circumvent client privacy safeguards and trigger outbound network requests upon display.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
