CVE-2026-114722: CWE-669 Incorrect Resource Transfer Between Spheres in Roundcube Webmail

Roundcube Webmail versions prior to 1.6.20 and 1.7.5 contain a CSS scoping bypass vulnerability due to improper handling of CSS at-rule prologues such as '@layer a;' and selectors beginning with '::' within HTML messages. The function rcube_utils::mod_css_styles() failed to treat these as selector boundaries, causing subsequent selectors to be applied globally to the entire Roundcube interface rather than being confined to the message body. This allows an attacker to craft HTML emails that can visually manipulate the user interface, potentially misleading users through UI redressing or spoofing. The issue was fixed upstream in a commit titled “Fix CSS scoping bypass in HTML messages using at-rules.”

An attacker can send specially crafted HTML emails that manipulate the Roundcube Webmail interface appearance beyond the message content area. This can lead to UI redressing and spoofing, potentially tricking users into performing unintended actions or revealing sensitive information. The confidentiality and integrity of the user interface are impacted, but availability is not affected. There is no indication of active exploitation in the wild.

A fix is available in Roundcube Webmail versions 1.6.20 and 1.7.5 and later. Users and administrators should upgrade to these versions or newer to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.