The vulnerability resides in Roundcube Webmail’s CSS sanitization routine for HTML email content. Because the filtering is insufficient, attackers can embed style directives that include the !important rule, which overrides the webmail interface’s fixed‑position styles. This allows a malicious email to rearrange or hide UI elements, potentially tricking users into interacting with deceptive controls or facilitating phishing attacks. The weakness corresponds to a lack of strict input validation and is identified as CWE‑669.

Roundcube Webmail is the affected product. Versions earlier than 1.5.14 and 1.6.14 are vulnerable. Installing any release 1.5.13 or earlier, or 1.6.13 or earlier, exposes the system to this manipulation attack. Versions 1.5.14 and above, and 1.6.14 and above, contain the fix.

The CVSS score of 5.3 indicates moderate severity. No public exploit code is known, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. The likely attack vector is the delivery of a malicious HTML email that the victim opens in the webmail client, enabling the attacker to inject the problematic CSS. Administrators should consider this a moderate risk and apply the patch promptly.