CVE-2026-35544

MediumCVSS 5.3

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

In Roundcube Webmail before versions 1.5.14 and 1.6.14, insufficient CSS sanitization in HTML messages was found. This allows bypassing fixed-position mitigation via the !important directive.

Risk Assessment

An attacker can alter the UI layout, potentially hiding warning elements or impersonating trusted content.

Recommendation

Update Roundcube Webmail to version 1.5.14 or later (for 1.5.x branch) or 1.6.14 or later (for 1.6.x branch).

Original NVD description (English source)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.