CVE Catalog
CVE-2026-74998
HighCVSS 7.2Summary
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS proxy were not validated, which may result in information disclosure or XSS via MIME sniffing.
Risk Assessment
An attacker could exploit this to steal user data or execute malicious scripts in the victim's browser.
Recommendation
Update Roundcube to version 1.6.18 or 1.7.3 (or later) and enable security headers.
Original NVD description (English source)
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.