An attacker can craft an e‑mail with a BODY element that uses a background attribute pointing to a remote image. The Roundcube Webmail remote image blocking feature can be bypassed, allowing the client to fetch the external resource. This behavior may result in the disclosure of sensitive data or enable an access‑control bypass. The underlying weakness is an improper enforcement of access controls, classified as CWE‑669.

Roundcube Webmail installations running a version older than 1.5.14 or 1.6.14 are affected. Any environment that has not applied these updates remains vulnerable.

The vulnerability has a CVSS score of 5.3 and no EPSS score or KEV listing is available. By sending a specially crafted email containing a BODY element with a background attribute, an attacker can cause the webmail interface to retrieve a remote image. This can expose information or help bypass intended restrictions. The risk is moderate in contexts that accept unsolicited or malicious email content and in which the content is rendered before being displayed to the user.