CVE-2026-26079

4.7 MEDIUM
Published: February 11, 2026 Modified: February 11, 2026
View on NVD

Description

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/roundcube/roundcubemail/commit/1f4c3a5af5033747f9685a8a395dbd8228d19816
Source: cve@mitre.org
https://github.com/roundcube/roundcubemail/commit/2b5625f1d2ef7e050fd1ae481b2a52dc35466447
Source: cve@mitre.org
https://github.com/roundcube/roundcubemail/commit/53d75d5dfebef235a344d476b900c20c12d52b01
Source: cve@mitre.org
https://github.com/roundcube/roundcubemail/commit/5a3315cce587e0be58335d11ff9a5571c90494a5
Source: cve@mitre.org
https://github.com/roundcube/roundcubemail/commit/bf89cbaa5897d8ad62e8057d9a3f6babb90b7954
Source: cve@mitre.org
https://github.com/roundcube/roundcubemail/commit/c15f5dbf093a497e19a749b20e7f8fb5a9c24cde
Source: cve@mitre.org
https://github.com/roundcube/roundcubemail/releases/tag/1.5.13
Source: cve@mitre.org
https://github.com/roundcube/roundcubemail/releases/tag/1.6.13
Source: cve@mitre.org
https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13
Source: cve@mitre.org

9 reference(s) from NVD

Quick Stats

CVSS v3 Score
4.7 / 10.0
EPSS (Exploit Probability)
0.1%
25th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-829

Related CVEs

CVE-2026-4544 2.4
CVE-2026-4543 6.3
CVE-2026-4542 5.4
CVE-2026-4541 2.5
CVE-2026-4540 7.3