Description

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.

INFO

Published Date :

2026-02-11T04:27:24.156Z

Last Modified :

2026-02-11T16:06:28.336Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2026-26079 vulnerability.

Vendors Products
Roundcube
  • Webmail
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-26079.

URL Resource
https://github.com/roundcube/roundcubemail/commit/1f4c3a5af5033747f9685a8a395dbd8228d19816 cve-icon cve-icon cve-icon
https://github.com/roundcube/roundcubemail/commit/2b5625f1d2ef7e050fd1ae481b2a52dc35466447 cve-icon cve-icon cve-icon
https://github.com/roundcube/roundcubemail/commit/53d75d5dfebef235a344d476b900c20c12d52b01 cve-icon cve-icon cve-icon
https://github.com/roundcube/roundcubemail/commit/5a3315cce587e0be58335d11ff9a5571c90494a5 cve-icon cve-icon cve-icon
https://github.com/roundcube/roundcubemail/commit/bf89cbaa5897d8ad62e8057d9a3f6babb90b7954 cve-icon cve-icon cve-icon
https://github.com/roundcube/roundcubemail/commit/c15f5dbf093a497e19a749b20e7f8fb5a9c24cde cve-icon cve-icon cve-icon
https://github.com/roundcube/roundcubemail/releases/tag/1.5.13 cve-icon cve-icon cve-icon
https://github.com/roundcube/roundcubemail/releases/tag/1.6.13 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-26079 cve-icon
https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13 cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-26079 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact