CVE-2026-35544: Roundcube Webmail

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.

Affected products

• Roundcube Webmail: up to and including 1.5.13; from 1.6.0, up to and including 1.6.13

Published 2026-04-03. Last modified 2026-07-24.