Bug 2558720 (CVE-2026-114722) - CVE-2026-114722 roundcubemail: Roundcube Webmail: Interface spoofing via CSS scoping bypass in HTML messages
Summary: CVE-2026-114722 roundcubemail: Roundcube Webmail: Interface spoofing via CSS ...
Keywords:
Status: NEW
Alias: CVE-2026-114722
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2558796 2558797
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-22 02:01 UTC by OSIDB Bzimport
Modified: 2026-10-22 09:31 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-22 02:01:51 UTC 
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.
Note You need to log in before you can comment on or make changes to this bug.