CVE-2026-114722: Roundcube Webmail CSS Scoping XSS Flaw

CVE-2026-114722 Overview

CVE-2026-114722 is a CSS scoping bypass in Roundcube Webmail affecting versions before 1.6.20 and 1.7.x before 1.7.5. The function rcube_utils::mod_css_styles() fails to treat an at-rule prologue such as @layer a; as a selector boundary. It also does not handle selectors beginning with ::. Selectors following an at-rule remain unscoped and apply to the entire Roundcube interface instead of the message body. An attacker can send a crafted HTML email that restyles Roundcube application chrome to perform user interface (UI) redressing and spoofing attacks against recipients. The flaw is classified under [CWE-669] Incorrect Resource Transfer Between Spheres.

Critical Impact
An HTML email can override Roundcube's application interface styling, enabling convincing phishing overlays and UI redressing against authenticated webmail users.

Affected Products

Roundcube Webmail versions before 1.6.20
Roundcube Webmail 1.7.x versions before 1.7.5
The vulnerable code resides in program/lib/Roundcube/rcube_utils.php

Discovery Timeline

2026-10-19 - Roundcube releases security updates 1.6.20 and 1.7.5
2026-10-22 - CVE-2026-114722 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114722

Vulnerability Analysis

Roundcube rewrites CSS declarations inside inbound HTML messages to confine them to the rendered message body container. The mod_css_styles() routine uses a regular expression to find selector boundaries and prepend a container-scoped prefix. The original expression recognized only ^, ,, }, and { as selector boundaries. It did not account for CSS at-rule prologues such as @layer a; or selectors beginning with the :: pseudo-element syntax. A selector that follows an at-rule therefore escapes the rewrite step. The resulting CSS applies to the whole Roundcube Document Object Model (DOM) rather than the message viewer. An attacker exploits this to overlay fake login prompts, hide warning banners, or impersonate toolbar controls.

Root Cause

The root cause is incomplete lexical parsing of CSS inside the sanitizer. The scoping regex treats CSS as a simple sequence of declarations separated by braces and commas. It ignores at-rule syntax where a prologue terminated by ; or { introduces a new selector context. Because the follow-on selector is not matched by the boundary group, the callback that prepends the container identifier is never invoked. The sanitizer also fails to recognize selectors starting with ::, leaving pseudo-element rules unscoped.

Attack Vector

Exploitation requires no authentication from the attacker and no interaction from the victim beyond opening the message. The attacker sends an HTML email containing a <style> block that uses an at-rule such as @layer followed by selectors that target Roundcube interface elements. When the victim previews the message, the unscoped rules redecorate application chrome, enabling spoofing of login dialogs, status indicators, and action buttons.

php

// Patch to program/lib/Roundcube/rcube_utils.php
// Source: https://github.com/roundcube/roundcubemail/commit/95b81ae12e2819a9b7e8636b5859b6244cda383e
            // Exclude rcube_string_replacer pattern matches, this is needed
            // for cases like @media { body { position: fixed; } } (#5811)
            $excl = '(?!' . substr($replacements->pattern, 1, -1) . ')';
-            $regexp = '/(^\s*|,\s*|\}\s*|\{\s*)(' . $excl . ':?[a-z0-9\._#\*\[][a-z0-9\._:\(\)#=~ \[\]"\|\>\+\$\^-]*)/im';
+            $regexp = '/(^\s*|,\s*|\}\s*|\{\s*|@[^;{]*[;{]\s*)'
+                . '(' . $excl . ':?[a-z0-9\._#\*\[:][a-z0-9\._:\(\)#=~ \[\]"\|\>\+\$\^-]*)/im';
            $callback = static function ($matches) use ($container_id, $prefix) {
                $replace = $matches[2];

The fix adds @[^;{]*[;{]\s* to the boundary alternation so at-rule prologues are recognized as selector delimiters. The selector character class also now includes : as a leading character to handle :: pseudo-element selectors.

Detection Methods for CVE-2026-114722

Indicators of Compromise

Inbound HTML emails containing <style> blocks with @layer, @scope, or other at-rules immediately followed by selectors targeting Roundcube element identifiers such as #messagelist, #taskbar, or .toolbar.
Message bodies containing CSS selectors beginning with :: that reference application-level elements rather than content inside the message viewer.
Reports from users of unexpected changes to Roundcube login screens, dialog prompts, or toolbars when viewing a specific message.

Detection Strategies

Inspect messages stored on the mail server for <style> blocks that combine at-rules with selectors naming Roundcube DOM identifiers.
Compare rendered message markup against expected scoped output by checking whether all selectors are prefixed with the container identifier produced by mod_css_styles().
Correlate user-reported phishing complaints with the specific HTML message content to identify crafted payloads.

Monitoring Recommendations

Log Roundcube version strings exposed by HTTP responses and alert when deployments remain below 1.6.20 or 1.7.5.
Monitor web server access logs for anomalous POSTs to login endpoints originating from inside an authenticated session.
Capture outbound credential submissions from webmail users and compare destinations against the configured Roundcube login endpoint.

How to Mitigate CVE-2026-114722

Immediate Actions Required

Upgrade Roundcube Webmail to 1.6.20 or 1.7.5 as announced in the Roundcube Security Update Announcement.
Apply the upstream fix tracked in Roundcube Commit 95b81ae1 and Roundcube Commit ff9cf4a9 if a backport is required.
Notify webmail users to report any unusual visual changes in the Roundcube interface and to verify URLs before entering credentials.

Patch Information

The maintainers released fixed builds documented in the Roundcube Release Notes v1.6.20 and the Roundcube Release Notes v1.7.5. Distribution tracking is available in Debian Bug Report #1151279. The patch updates the selector boundary regular expression in rcube_utils::mod_css_styles() to recognize at-rule prologues and :: pseudo-element selectors as scoping boundaries.

Workarounds

Disable HTML message rendering in Roundcube user preferences and display messages as plain text where feasible.
Apply an upstream-aligned patch to program/lib/Roundcube/rcube_utils.php that replaces the boundary regex with the fixed pattern.
Restrict access to the webmail interface to trusted networks until patched builds are deployed.

bash

# Verify installed Roundcube version meets the fixed release
grep -R "RCMAIL_VERSION" /var/www/roundcube/program/include/ | head -n 1
# Expected output should show 1.6.20 or 1.7.5 or later