Insufficient CSS Sanitization in Roundcube Webmail Affects Security
CVE-2026-35544

5.3MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
3 April 2026

What is CVE-2026-35544?

A vulnerability was identified in Roundcube Webmail versions before 1.5.14 and 1.6.14, where insufficient sanitization of Cascading Style Sheets (CSS) within HTML e-mail messages could be exploited. Attackers may leverage this weakness to conduct a fixed-position mitigation bypass using the CSS !important rule, potentially enabling the manipulation of displayed content or presentation in unintended ways. This emphasizes the importance of timely updates and adherence to security best practices.

Affected Version(s)

Webmail 0 < 1.5.14

Webmail 1.6.0 < 1.6.14

References

https://roundcube.net/news/2026/03/18/security-updates-1....
https://github.com/roundcube/roundcubemail/releases/tag/1...
https://github.com/roundcube/roundcubemail/commit/226811a...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.