Live › vulnerability › CVE-2026-114719
Go to dashboardThe markasjunk plugin in Roundcube Webmail reads the message UID in a way that lets the CSRF token check be skipped. An attacker who lures a logged-in user to a crafted page can get the user's mail marked as junk without the user's consent.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host Roundcube Webmail with the markasjunk plugin enabled, on versions before 1.6.20 or in the 1.7.x line before 1.7.5. Installations without the markasjunk plugin or on patched versions are not affected; hosted mail providers handle their own patching.
No product ranges from the sources yet.
grep RCMAIL_VERSION program/include/iniset.php or the version shown in the admin panel.config/config.inc.php under $config['plugins'].1.6.20 on the 1.6 line or 1.7.5 on the 1.7 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly.
This page as .md · .json · in your agent: get_signal("CVE-2026-114719")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.