Information Disclosure Vulnerability in Roundcube Webmail by Roundcube
CVE-2026-48845

6.5MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
25 May 2026

What is CVE-2026-48845?

In certain versions of Roundcube Webmail, a flaw exists where remote image blocking fails to apply to URLs directed at local or private destinations. This vulnerability could be exploited by attackers via specially crafted HTML email messages, potentially leading to unauthorized access to sensitive information or privilege escalation.

Affected Version(s)

Webmail 1.6.14 < 1.6.16

Webmail 1.7.0 < 1.7.1

References

https://roundcube.net/news/2026/05/24/security-updates-1....
https://github.com/roundcube/roundcubemail/releases/tag/1...
https://github.com/roundcube/roundcubemail/commit/d82b8c6...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.