CVE-2026-62643 is a high-severity SSRF vulnerability in Roundcube Webmail caused by inadequate sanitization of Cascading Style Sheets (CSS) in HTML emails. Specifically, malicious emails can include stylesheet links that cause the server to make unintended requests to internal or local network hosts, potentially exposing sensitive information. This vulnerability affects Roundcube Webmail versions prior to 1.6.17 and 1.7.2 and is a regression from incomplete remediation of previous SSRF issues (CVE-2026-35540 and CVE-2026-48843). The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with scope change.

Successful exploitation can lead to server-side requests to internal or local network resources, potentially disclosing sensitive information or enabling further attacks within the internal network. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

No official patch or remediation level has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when processing HTML emails with external CSS links, especially those referencing local network addresses. Monitoring vendor communications for updates is recommended.