This vulnerability in Roundcube Webmail affects versions prior to 1.5.14 and 1.6.14. The issue arises because the remote image blocking feature can be circumvented by using a crafted background attribute in the BODY element of an email message. This flaw allows an attacker to bypass intended access controls or cause information disclosure by exploiting the incorrect handling of resource transfers between security contexts, classified under CWE-669. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation can lead to unauthorized information disclosure or bypass of access controls in affected Roundcube Webmail installations. This could expose sensitive user data or allow attackers to circumvent security restrictions intended to block remote content. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Roundcube's official channels for updates. Until a patch is available, consider applying temporary mitigations such as disabling remote image loading or restricting email content rendering features if feasible.