CVE-2026-74999 is a stored XSS vulnerability in Roundcube Webmail affecting versions prior to 1.6.18 and 1.7.x prior to 1.7.3. The vulnerability exists in the "Add to address book" action, where malicious scripts can be stored and later executed in the context of the victim's browser session. Exploitation requires network access, low attack complexity, privileges to perform the action, and user interaction. The vulnerability impacts confidentiality and integrity but not availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to disclosure of sensitive information or manipulation of data within the webmail interface. The vulnerability does not affect system availability. The CVSS vector indicates a moderate severity with partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to Roundcube Webmail version 1.6.18 or later, or 1.7.3 or later, once official fixes are available. Until then, limit privileges for users where possible and exercise caution with the "Add to address book" feature.