This vulnerability in Roundcube Webmail involves an incorrect resource transfer between security spheres (CWE-669). Specifically, the remote image blocking feature intended to prevent automatic loading of external images can be circumvented by embedding SVG content with animate attributes in emails. This flaw may expose users to information disclosure or allow bypassing access controls. The issue affects versions prior to 1.5.14 and 1.6.14. The CVSS 3.1 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to confidentiality.

Successful exploitation can lead to partial information disclosure or bypass of access controls within the Roundcube Webmail client. This could expose sensitive user information or allow unauthorized actions that the remote image blocking feature was designed to prevent. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor Roundcube's official channels for updates and apply any released patches promptly. Until a fix is available, consider disabling or restricting SVG content rendering in emails if possible.