CVE-2026-114719: CSRF
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcubeutils::INPUTPOST explicitly.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
roundcube/roundcubeto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
roundcube/roundcubeto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Which deployments need remediation?
Roundcube Webmail versions before 1.6.20 and 1.7.x versions before 1.7.5 are affected when using the mark-as-junk action provided by the markasjunk plugin. Upgrade to 1.6.20 or 1.7.5, as appropriate for the release line.
How can a custom patch or backport be checked for the fix?
The corrected code passes rcube_utils::INPUT_POST explicitly when calling rcmail::get_uids() for the mark-as-junk action. This prevents _uid values from being re-read from the query string.
What is the stated impact of successful exploitation?
The affected action can be carried out without a valid CSRF token, allowing messages to be marked as junk. The supplied severity vector indicates low integrity impact and no confidentiality or availability impact.