CVE-2026-54433 is a high severity stored cross-site scripting flaw (CVSS 7.2) in Roundcube Webmail. A crafted plain-text email can run script in the reader's session just by being opened or previewed. It is fixed in Roundcube 1.6.17 and 1.7.2, released on 5 July 2026.
What's affected
- Roundcube Webmail before 1.6.17 on the 1.6 series, and 1.7.x before 1.7.2, per the record.
- Fixed in 1.6.17 and 1.7.2, per the Roundcube announcement.
- The same release fixes a second XSS, CVE-2026-54432, and several other issues.
How to check if you're exposed
Sign in to your webmail and read the version in the About dialog. If you run the Docker image or a distribution package, check the image tag or package version instead. If you are on 1.6.x below 1.6.17 or 1.7.x below 1.7.2, you are exposed. Hosting providers that offer Roundcube to many mailboxes should check every instance.
What to do now
- Update to Roundcube 1.6.17 or 1.7.2, whichever matches your series.
- Read the release notes for 1.6.17 and 1.7.2, since they include other security fixes.
- After updating, ask users to sign out and sign in again, to drop any sessions that could have been used.
- If you cannot update at once, consider limiting access to webmail until you can.
Why it matters
The class is CWE-79, cross-site scripting. Message content reached the page without safe handling, so text sent by an outsider became script in the context of a signed in user. The record calls it zero-click, because no link needs to be clicked. Opening or previewing is enough.
Webmail holds sensitive mail and often password reset messages, so script running in that session is serious. The record does not mark the CVE as exploited in the wild. Roundcube urges updating all production installations.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Does it need an attachment or a link?
The record describes a crafted plain-text message that triggers on open or preview. No click is needed.
Sources
Last reviewed: 19 October 2026.
