The vulnerability lies in the remote image blocking logic of Roundcube Webmail, allowing a crafted background attribute in a BODY element of an e‑mail to bypass the restriction. This flaw permits the rendering engine to retrieve externally hosted images, which can reveal user‑specific data or enable access‑control bypass. The weakness aligns with CWE‑669, which describes information leakage through functional parameters.

Roundcube Webmail installations running any release older than 1.5.14 or 1.6.14 are affected. The fix was incorporated into the 1.5.14, 1.6.14, and 1.7‑rc5 release streams announced in March 2026. Users running these or later versions are not vulnerable.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation, and the vulnerability is not present in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to deliver a malicious e‑mail containing the crafted BODY tag; the victim must open the message to trigger the bypass and receive the exposed data. This does not provide remote code execution or privilege escalation.