In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead… (CVE-2026-62643)

CVE-2026-62643 affects Roundcube Webmail prior to versions 1.6.17 and 1.7.2, where inadequate sanitization of CSS in HTML emails can lead to SSRF or information disclosure. Specifically, malicious CSS stylesheet links can cause the server to make unintended requests to internal network resources, potentially exposing sensitive information. This vulnerability is a result of insufficient remediation of earlier related vulnerabilities CVE-2026-35540 and CVE-2026-48843.

An attacker can exploit this vulnerability by sending crafted HTML emails containing malicious CSS that references internal network resources. This can lead to SSRF, allowing the attacker to make unauthorized requests from the server to internal hosts, or cause information disclosure of sensitive internal data. The CVSS score of 10.0 indicates a critical impact with network attack vector, no privileges or user interaction required, and high confidentiality and integrity impact.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, administrators should consider disabling HTML email rendering or applying any available updates from Roundcube that address this issue.