This vulnerability in Roundcube Webmail before versions 1.6.18 and 1.7.3 arises from insufficient sanitization of Cascading Style Sheets (CSS) in HTML email messages. Specifically, stylesheet links can point to local network hosts, enabling SSRF or information disclosure. The problem persists due to incomplete fixes for earlier vulnerabilities CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to information disclosure.

An attacker can exploit this vulnerability by sending crafted HTML emails with malicious CSS that references internal network resources. This can cause the Roundcube Webmail server to make unintended requests to internal hosts, potentially disclosing sensitive information. There is no indication of direct confidentiality, integrity, or availability impact beyond information disclosure. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Roundcube's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, consider restricting or filtering HTML email content or disabling automatic loading of external stylesheets if feasible.