Insufficient CSS sanitization in Roundcube Webmail allows an attacker to inject CSS rules that utilize the !important directive to override elements positioned with fixed positioning. This can bypass the intended fixed-position mitigation and cause hidden or protected UI components to become visible. Based on the description, the vulnerability may expose content that is otherwise hidden, though the exact extent depends on the email layout.

Roundcube Webmail, all releases prior to 1.5.14 and 1.6.14, including earlier 1.x versions, are affected. Upgrading to version 1.5.14, 1.6.14, or later releases such as 1.7-rc5 removes the flaw.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, suggesting limited exploitation. The vulnerability is likely exploitable via a crafted e‑mail containing malicious CSS. Delivery of such an email to a user of the affected version is sufficient for an attacker to trigger the bypass; no privileged access or code execution beyond the email content is required.