CVE-2026-48846
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
May 25, 2026
CISA due date
—
The record
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | roundcubemail | 0 | 1.6.16-2.1 |
Related vulnerabilities
- CVE-2026-48847 Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication… Also affects roundcubemail
- CVE-2026-48845 In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image… Also affects roundcubemail
- CVE-2026-48848 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML… Also affects roundcubemail
- CVE-2026-48849 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject… Also affects roundcubemail
- CVE-2026-48844 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation… Also affects roundcubemail
- CVE-2026-48843 Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient… Also affects roundcubemail
- CVE-2026-48842 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL… Also affects roundcubemail
- CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters… Also affects roundcubemail