CVE-2026-74998

The EPSS score of 0.00268 likely understates real-world risk. CVE-2026-74998 exploits a design flaw in Roundcube's CSS proxy architecture, not a traditional code bug—and that distinction matters for defenders. The proxy was implemented to isolate users from external CSS, but it creates a validation gap: it delivers content that browsers process as text/css without verifying the response. This is a MIME confusion attack vector where the proxy acts as an unverified conduit between external content and the browser. The CVSS 7.2 rating assumes technical barriers—MIME sniffing alignment, browser quirks—create exploitation difficulty. They don't. The real barrier is detection: CSS proxy bugs don't surface in standard scanners, and finding them requires understanding Roundcube's architecture deeply enough to ask what happens when the proxy delivers untrusted content. This filters out script kiddies but not nation-state actors or motivated APT groups who've already reverse-engineered the codebase. The credential cascade is the critical concern. Session cookies stolen via CSS injection enable email access, which enables password resets for every connected system. Email is the authentication anchor for your infrastructure—a validation gap here unlocks far more than the Roundcube instance. Compromised email can also reach deprecated SSO integrations, legacy admin consoles, and forgotten systems that were never properly retired, as these often rely on email for credential recovery. You need to verify three things immediately. First, determine whether the patch validates at the proxy layer (blocking malicious responses) or sanitizes CSS output (allowing content through with dangerous portions removed)—this affects whether stale malicious CSS could persist in caches post-patch. Second, audit your Roundcube plugin ecosystem and custom themes; third-party plugins routinely bypass the proxy entirely for performance reasons, leaving a wider attack surface even after core patching. Third, examine whether the proxy handler has accumulated legacy modifications over years of refactoring—the validation logic may have gaps that the current patch doesn't address. CSS MIME confusion attacks in email clients have recurred since the early 2000s across SquirrelMail, Horde, and now Roundcube. Each time the fix is similar, each time the institutional memory of why it matters gets lost. The question isn't just whether this patch is sufficient—it's whether Roundcube's development process has any mechanism to prevent this class from re-emerging when new CSS features land or when the proxy gets refactored for performance in eighteen months.

Reviewed through automated stages and approved by a human before publication.