CVE-2026-75006 affects Roundcube Webmail prior to versions 1.6.18 and 1.7.3. The vulnerability arises due to insufficient sanitization of CSS in HTML emails, which can be exploited to perform SSRF or leak information by referencing stylesheet links to internal network resources. This is a continuation of unresolved issues from earlier CVEs (CVE-2026-35540, CVE-2026-48843, CVE-2026-62643). The CVSS 3.1 base score is 5.8, indicating a moderate severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. No known exploits in the wild have been reported. No patch links or vendor advisories were provided in the input data.

An attacker can exploit this vulnerability by sending crafted HTML emails containing CSS that references internal network resources, potentially causing the Roundcube Webmail server to make unauthorized requests (SSRF) or disclose sensitive information. The impact is limited to information disclosure and SSRF without direct compromise of confidentiality or availability of the mail server itself. The vulnerability does not require user interaction or privileges, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, administrators should monitor vendor communications for updates. Until a fix is available, consider disabling HTML email rendering or restricting CSS content in emails as a temporary mitigation.