CVE-2026-48846
BaseFortify
Publication date: 2026-05-25
Last updated on: 2026-05-25
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| roundcube | roundcube | to 1.6.16 (exc) |
| roundcube | roundcube | to 1.7.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-669 | The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. It allows an attacker to bypass the remote image blocking feature by using a specially crafted CSS var() value within an email message.
By exploiting this bypass, the attacker may cause information disclosure or bypass access controls intended to protect the user.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized information disclosure or access-control bypass when using affected versions of Roundcube Webmail.
An attacker could exploit this flaw to access information that should be blocked or restricted, potentially compromising user privacy and security.