Executive brief
Roundcube Webmail, a widely used open-source web-based email client, contains a vulnerability that allows attackers to bypass privacy protections. By sending a specially crafted email, an attacker can force the recipient's browser to load remote images even if the user has chosen to block them. This can be used to track when a user opens an email, potentially leaking their IP address and other metadata to the sender.
Technical details
A vulnerability in Roundcube Webmail's HTML sanitizer allows for a bypass of the remote image blocking feature. The flaw exists in how the application handles CSS var() values within email messages. An attacker can craft an email containing specific CSS variables that reference external resources, which the sanitizer fails to properly neutralize. When a user views the email, the browser may fetch these remote resources automatically, leading to information disclosure (such as the user's IP address and user-agent) or potential access-control bypass. This issue is addressed in versions 1.6.16 and 1.7.1.
Affected products
- Roundcube Roundcube Webmail 1.6.x before 1.6.16, 1.7.x before 1.7.1
Timeline
- 2026-05-24: patched: Security updates 1.6.16 and 1.7.1 released.
- 2026-05-25: disclosed: CVE-2026-48846 published.
References
- https://github.com/roundcube/roundcubemail/commit/59cca80908a61e662c5f81741449e9aeb91e8abe
- https://github.com/roundcube/roundcubemail/commit/852350486b88b35b8544e8a630fad89e99e2150a
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.16
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.1
- https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1