In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in… (CVE-2026-48846)

In Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1, attackers can bypass the remote image blocking feature by exploiting a crafted CSS var() value embedded in an email message. This bypass can result in unauthorized information disclosure or access-control bypass. The vulnerability is identified as CVE-2026-48846 and has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). There are no known exploits in the wild, and the affected versions include multiple Debian/Ubuntu package versions as listed.

Successful exploitation allows an attacker to bypass the remote image blocking feature in Roundcube Webmail, potentially leading to information disclosure or unauthorized access control bypass. This could expose sensitive user information or allow actions that should be restricted by the remote image blocking mechanism.

A fix is available in Roundcube Webmail versions 1.6.16 and 1.7.1 and later. Users and administrators should upgrade to these versions or later to remediate this vulnerability. Since this is not a cloud service, manual patching is required. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.