CVE-2026-114722 Roundcube CVE debrief

Who should care

Defenders responsible for Roundcube Webmail deployments should assess exposure and prioritize patching to prevent potential UI redressing and spoofing attacks. This includes administrators, security teams, and IT personnel who manage Roundcube Webmail instances. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-114722 is a CSS scoping bypass vulnerability in Roundcube Webmail that allows an attacker to restyle application chrome for UI redressing and spoofing. Defenders should prioritize verifying and applying available patches to prevent potential attacks.

• Potential UI redressing and spoofing attacks
• Restyling of application chrome
• Verification of patch application

Technical summary

The rcube_utils::mod_css_styles() function did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. The vulnerability can be exploited by sending a specially crafted HTML message to the affected application. Defenders should prioritize verifying and applying the available patches to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying and applying the available patches to prevent potential UI redressing and spoofing attacks.

Recommended defensive actions

• Verify and apply available patches for Roundcube Webmail
• Monitor for potential UI redressing and spoofing attacks
• Restrict access to sensitive areas of the application
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was fixed in Roundcube Webmail versions 1.6.20 and 1.7.5. The NVD entry is currently Undergoing Analysis. Defenders should verify patch application and monitor for potential UI redressing and spoofing attacks. The CVE record was published on 2026-10-22T02:17:00.033Z and has not been modified since then. There is no evidence of exploitation in the wild, but defenders should still prioritize patching.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.