CVE-2026-35544

Katalog CVE

CVSS 5.3 · Medium EPSS 0,51%

Kerentanan Incorrect Resource Transfer Between Spheres pada roundcube webmail. Skor CVSS 3.1 5.3 (Medium) menurut mitre.org.

Deskripsi (NVD)

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-669: Incorrect Resource Transfer Between Spheres

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/099009b9c8e1d3c636fb9a5af72f7c2596018662 patch
• https://github.com/roundcube/roundcubemail/commit/226811a1c974271dbedca72672923abaff8191c0 patch
• https://github.com/roundcube/roundcubemail/commit/57dec0c127b98e0c8e3b9c26c80049b9c4bcaea7 patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 release notes