Vulnerabilities

CVSS

7.2 High

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Risk score

57.6

Published

2026-07-14

Status

Published

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).

Weaknesses

CWE-79

Coverage 1

vulnerability

Multiples vulnérabilités dans Roundcube (06 juillet 2026)

Multiple vulnerabilities have been discovered in Roundcube Webmail, impacting versions 1.6.x (prior to 1.6.17) and 1.7.x (prior to 1.7.2). These vulnerabilities include denial-of-service attacks, server-side request forg…

CERT-FR · Jul 6, 2026 Medium

CVE-2026-54432CVE-2026-54433CVE-2026-62641webmailvulnerabilityssrf

All articles mentioning it

Advisories and references

• roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2