CVE-2026-54433: Roundcube Webmail XSS Vulnerability

CVE-2026-54433 Overview

CVE-2026-54433 is a stored Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail affecting versions before 1.6.17 and 1.7.x before 1.7.2. Attackers deliver a crafted plain-text email message that carries JavaScript payloads. The payload executes inside the victim's authenticated session when the message is opened or previewed. This is a zero-click condition because previewing an inbox item alone triggers execution. Exploitation requires no authentication on the attacker's side and no user interaction beyond viewing the mailbox. Successful attacks let adversaries read messages, exfiltrate mail data, send mail as the victim, and pivot to account takeover [CWE-79].

Critical Impact
A remote, unauthenticated attacker can hijack Roundcube user sessions by sending a single crafted email that runs JavaScript on preview.

Affected Products

Roundcube Webmail versions prior to 1.6.17
Roundcube Webmail 1.7.x versions prior to 1.7.2
Self-hosted Roundcube deployments using vulnerable release branches

Discovery Timeline

2026-07-05 - Roundcube publishes security updates 1.6.17 and 1.7.2
2026-07-14 - CVE-2026-54433 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-54433

Vulnerability Analysis

Roundcube Webmail fails to correctly sanitize content in plain-text email messages before rendering them in the browser. An attacker embeds crafted markup or script constructs into the plain-text body. When Roundcube converts that body to HTML for display, the sanitizer allows attacker-controlled JavaScript to survive into the rendered Document Object Model (DOM). The script then executes with the origin and session cookies of the logged-in user. Because the payload lives inside a stored mail message, every subsequent open or preview retriggers execution.

Root Cause

The defect is an improper neutralization of input during web page generation [CWE-79]. The plain-text-to-HTML rendering path in the affected versions does not strip or escape all script-carrying constructs. The scope-changed CVSS impact indicates that the injected script crosses the trust boundary from mail content to the authenticated Roundcube application context.

Attack Vector

The vulnerability is exploitable across the network with no privileges and no user interaction beyond normal mailbox use. An attacker sends a single email to any Roundcube user. When the user selects the message, or when the preview pane auto-renders it, the payload executes. Attackers can read and forward mail, alter mailbox rules, harvest CSRF tokens, and issue authenticated requests to the Roundcube backend on behalf of the victim.

No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities (KEV) listing is currently associated with this CVE. See the Roundcube Security Updates Announcement for advisory details.

Detection Methods for CVE-2026-54433

Indicators of Compromise

Inbound emails whose plain-text bodies contain HTML-like tags, event handler attributes such as onerror or onmouseover, or javascript: URI fragments.
Unexpected outbound mail, new sieve or filter rules, or forwarding addresses added to user accounts shortly after a suspicious message is opened.
Anomalous XHR or fetch calls from the Roundcube frontend to ?_task=mail or ?_task=settings endpoints outside normal user workflows.

Detection Strategies

Inspect mail server logs and MTA content filters for plain-text messages containing script tags, HTML event handlers, or encoded script payloads.
Correlate Roundcube web access logs with mailbox events to identify sessions that issue high-volume API requests immediately after opening a specific message.
Compare installed Roundcube versions against 1.6.17 and 1.7.2 across all web-facing hosts to identify vulnerable instances.

Monitoring Recommendations

Enable and centralize Roundcube application logs, including login events, task actions, and configuration changes.
Alert on mailbox rule modifications, new forwarding addresses, and password or recovery email changes performed through the Roundcube UI.
Monitor egress from the webmail host for unusual connections to attacker-controlled domains referenced in email bodies.

How to Mitigate CVE-2026-54433

Immediate Actions Required

Upgrade Roundcube Webmail to 1.6.17 or 1.7.2 on every self-hosted instance without delay.
Invalidate active Roundcube sessions and force re-authentication after patching to evict any hijacked sessions.
Audit mailboxes for unauthorized filters, forwarding rules, and sent items created since the vulnerable version was deployed.

Patch Information

Roundcube released fixed builds on 2026-07-05. Administrators should download and deploy 1.6.17 for the 1.6 branch or 1.7.2 for the 1.7 branch as documented in the Roundcube Security Updates Announcement. Restart the web server and clear cached templates after upgrading.

Workarounds

Restrict access to the Roundcube UI to trusted networks or VPN users until patches are deployed.
Deploy a strict Content Security Policy (CSP) on the Roundcube virtual host to limit inline script execution.
Disable the message preview pane and instruct users to avoid opening messages from unknown senders until upgrade completion.

bash

# Configuration example: verify installed Roundcube version and upgrade
grep -R "RCMAIL_VERSION" /var/www/roundcube/program/include/iniset.php
# Expected after patch: 1.6.17 or 1.7.2

# Example CSP header for the Roundcube vhost (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";