CVE-2026-48843 is a high-severity SSRF vulnerability in Roundcube Webmail affecting versions 1.6.14 and 1.7.0. The root cause is insufficient sanitization of cascading style sheets in HTML emails, which can lead to the server fetching external or internal resources referenced by stylesheet links. This can result in information disclosure or SSRF attacks. The vulnerability stems from an incomplete remediation of an earlier related vulnerability (CVE-2026-35540). The CVSS 3.1 base score is 7.2, indicating a high impact with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

Successful exploitation could allow an attacker to induce the Roundcube Webmail server to make unauthorized requests to internal or external resources, potentially leading to information disclosure. The vulnerability does not directly allow code execution or denial of service but can be leveraged to access sensitive internal network resources or data accessible via SSRF.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor the Roundcube project for updates addressing this vulnerability. Until a fix is available, consider restricting server outbound HTTP requests or applying network-level controls to limit SSRF impact.