Back Cybersecuritynews

Roundcube Webmail Vulnerability Let Attackers Track Email Opens

Cybersecuritynews •Guru Baran • February 9, 2026

Roundcube, one of the world’s most popular open-source webmail solutions, has released critical security updates to address a privacy bypass vulnerability. The flaw detailed by NULL CATHEDRAL allowed attackers to load remote images and track email opens, even when users had explicitly configured their settings to “Block remote images.” The vulnerability affects Roundcube Webmail versions […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Roundcube Webmail Vulnerability Allows Email Open Tracking A critical Cross-Site Scripting (XSS) vulnerability has been identified in Roundcube Webmail, enabling attackers to track email opens by loading remote images. This flaw affects users who have set their preferences to block remote images, compromising their privacy. Security updates have been released to address this issue. 23 sources 26

Extracted Entities

Platforms (1)

Roundcube Webmail