This vulnerability in Roundcube Webmail involves an incorrect resource transfer between security spheres (CWE-669). Specifically, the remote image blocking feature intended to prevent automatic loading of external images can be bypassed by crafting the background attribute of the BODY element in an email. This bypass may allow an attacker to disclose information or bypass access controls by forcing the client to load remote content despite protections. The issue affects versions prior to 1.5.14 and 1.6.14. No patch or official remediation guidance is currently documented.

Successful exploitation can lead to information disclosure or access-control bypass due to the bypass of remote image blocking. This could expose users to privacy risks or unauthorized data access. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening emails from untrusted sources and consider disabling remote content loading by other means if possible.