Roundcube Webmail apps before 1.6.20 and 1.7.x before 1.7.5 allow a CSS scoping bypass in email messages. The code failure caused at‑rule prologues such as @layer a; to be treated like a selector boundary, and selectors beginning with :: were not protected, so styles after an at‑rule were applied globally instead of being limited to the message body. As a result a malicious HTML message could restyle the entire interface, enabling UI redressing and spoofing of the application chrome. This is a CSS scoping bypass, a type of CWE-669 vulnerability.

All Roundcube Webmail deployments operating versions before release 1.6.20 or before release 1.7.5 are susceptible. The default build of Roundcube that ships with a webmail product under those version numbers is affected. No other products or plugins are mentioned as impacted.

The CVSS score of 6.5 classifies the vulnerability as a moderate risk. EPSS is not available, so no quantified exploitation probability is provided. The issue is not listed in CISA KEV. The likely attack vector is an attacker sending an HTML email that contains at‑rules and selectors targeting the webmail UI; the exploit occurs client‑side when the victim opens or views the message. No authentication or elevated privileges are required beyond typical user access to the mailbox.