CVE-2026-48845
MEDIUM
CVSS 6.5
No EPSS data
Description
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.
CVSS details
EPSS
This CVE is not currently listed in the EPSS dataset.
Show JSON
{
"cve": {
"id": "CVE-2026-48845",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cve@mitre.org",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.5,
"exploitabilityScore": 3.9
}
]
},
"published": "2026-05-25T20:16:37.027",
"references": [
{
"url": "https://github.com/roundcube/roundcubemail/commit/7b52353653a67e6073b97d70eb94047132b78556",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/roundcube/roundcubemail/commit/d82b8c6cd06c378eca6d647ccd548f4ff1c68659",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.16",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.1",
"source": "cve@mitre.org"
},
{
"url": "https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1",
"source": "cve@mitre.org"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Primary",
"source": "cve@mitre.org",
"description": [
{
"lang": "en",
"value": "CWE-669"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message."
}
],
"lastModified": "2026-05-26T19:26:42.643",
"sourceIdentifier": "cve@mitre.org"
}
}