UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the…

Severity
Medium 6.5
Published
22 Oct 2026
Last changed
2 Nov 2026
Added to UpHeron
3 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
NVD, CVE Program

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cna:roundcube|webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5
RoundcubeServers and applications · cpe:a:roundcube:webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-114722
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114722