Bug 2558720 (CVE-2026-114722)

Summary: CVE-2026-114722 roundcubemail: Roundcube Webmail: Interface spoofing via CSS scoping bypass in HTML messages
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Roundcube Webmail. When rendering incoming HTML messages, the application fails to properly confine Cascading Style Sheets (CSS) styling rules to the email body. A remote attacker can exploit this issue by sending a specially crafted email that alters the surrounding webmail interface. Successful exploitation allows an attacker to conduct user interface (UI) redressing and phishing attacks by spoofing elements of the application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2558796, 2558797    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-22 02:01:51 UTC 
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.