Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Published: 2026-05-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Sat, 30 May 2026 10:30:00 +0000

Type Values Removed Values Added
Title Roundcube Local/Private URL Fetch Bypass
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 28 May 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-184
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N'}

Thu, 28 May 2026 17:00:00 +0000

Type Values Removed Values Added
Description Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services simply by opening the message preview. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CPEs cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*

Thu, 28 May 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 28 May 2026 12:45:00 +0000

Type Values Removed Values Added
Description Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services simply by opening the message preview.
Title Roundcube Local/Private URL Fetch Bypass
First Time appeared Roundcube
Roundcube webmail
Weaknesses CWE-184
CPEs cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Vendors & Products Roundcube
Roundcube webmail
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N'}

Subscriptions

Roundcube Webmail
cve-icon MITRE

Status: REJECTED

Assigner: OCD

Published:

Updated: 2026-05-28T16:35:38.661Z

Reserved: 2026-05-28T10:37:45.625Z

Link: CVE-2026-9818

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-05-28T13:16:25.440

Modified: 2026-05-28T17:16:36.090

Link: CVE-2026-9818

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-28T16:30:15Z

Weaknesses

No weakness.