CVE-2026-48846: Roundcube Webmail remote image blocking bypass via CSS var()

CVE-2026-48846 · Severity: medium · CVSS 6.5 · Published 2026-05-25

Roundcube Webmail, a widely used open-source web-based email client, contains a vulnerability that allows attackers to bypass privacy protections. By sending a specially crafted email, an attacker can force the recipient's browser to load remote images even if the user has chosen to block them. This can be used to track when a user opens an email, potentially leaking their IP address and other metadata to the sender.

Technologies: Roundcube Webmail. Vendors: Roundcube.

Quick answers

Is CVE-2026-48846 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48846 being exploited in the wild.
How severe is CVE-2026-48846?
Medium severity, with a CVSS score of 6.5, published 25 May 2026.
Which products and versions are affected?
Roundcube Webmail 1.6.x before 1.6.16, 1.7.x before 1.7.1.
Is there a fix for CVE-2026-48846?
A patch was published on 2026-05-24: Security updates 1.6.16 and 1.7.1 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48846 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48846?
Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Roundcube Webmail's HTML sanitizer allows for a bypass of the remote image blocking feature. The flaw exists in how the application handles CSS var() values within email messages. An attacker can craft an email containing specific CSS variables that reference external resources, which the sanitizer fails to properly neutralize. When a user views the email, the browser may fetch these remote resources automatically, leading to information disclosure (such as the user's IP address and user-agent) or potential access-control bypass. This issue is addressed in versions 1.6.16 and 1.7.1.

Affected products

  • Roundcube Roundcube Webmail 1.6.x before 1.6.16, 1.7.x before 1.7.1

Timeline

  • 2026-05-24: patched: Security updates 1.6.16 and 1.7.1 released.
  • 2026-05-25: disclosed: CVE-2026-48846 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.