{"id":"CVE-2026-114719","kind":"vulnerability","aliases":["CVE-2026-114719"],"related":[],"title":"Roundcube Webmail: CSRF bypass lets forged requests mark mail as junk","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly.","summary":"The markasjunk plugin in Roundcube Webmail reads the message UID in a way that lets the CSRF token check be skipped. An attacker who lures a logged-in user to a crafted page can get the user's mail marked as junk without the user's consent.","severity":"low","cvss":3.7,"epss":0.00246,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","roundcube","self-hosted","webmail"],"not_affected_if":["managed-hosting","patched-version","plugin-disabled"],"how_to_check":"- Check the Roundcube version with `grep RCMAIL_VERSION program/include/iniset.php` or the version shown in the admin panel.\n- Confirm the markasjunk plugin is enabled in `config/config.inc.php` under `$config['plugins']`.","fix":"- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 line or `1.7.5` on the 1.7 line.\n- Until upgraded, disable the markasjunk plugin if junk marking is not needed.","status":"open","published_at":"2026-10-22T02:16:59+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:43:31+00:00","updated_at":"2026-10-25T04:43:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:43:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 line or `1.7.5` on the 1.7 line.\n- Until upgraded, disable the markasjunk plugin if junk marking is not needed.","reach":"internet","title":"Roundcube Webmail: CSRF bypass lets forged requests mark mail as junk","impact":"low","summary":"The markasjunk plugin in Roundcube Webmail reads the message UID in a way that lets the CSRF token check be skipped. An attacker who lures a logged-in user to a crafted page can get the user's mail marked as junk without the user's consent.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","webmail"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker marks a victim's mail as junk through forged requests","analyst_note":"","how_to_check":"- Check the Roundcube version with `grep RCMAIL_VERSION program/include/iniset.php` or the version shown in the admin panel.\n- Confirm the markasjunk plugin is enabled in `config/config.inc.php` under `$config['plugins']`.","needs_analyst":false,"not_affected_if":["patched-version","plugin-disabled","managed-hosting"],"who_is_affected":"Teams that self-host Roundcube Webmail with the markasjunk plugin enabled, on versions before 1.6.20 or in the 1.7.x line before 1.7.5. Installations without the markasjunk plugin or on patched versions are not affected; hosted mail providers handle their own patching.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000641,"input_tokens":3475,"output_tokens":587,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-114719':14A,17A '-2026':13A,16A '1.6.20':75C '1.7':77C '1.7.5':80C 'action':94C,137C,161C 'affect':82C 'attack':46B 'bypass':4A,87C,154C 'carri':138C 'check':42B 'commit':150C 'consent':71B 'constrain':116C 'could':128C 'craft':56B 'csrf':3A,40B,85C,143C,152C 'cve':12A,15A 'data':107C 'explicit':168C 'fix':146C,151C 'forg':6A 'get':59B,113C 'helper':127C 'host':22B 'input':118C,166C 'insid':125C 'junk':11A,66B,93C,160C 'let':5A,38B 'log':51B 'logged-in':50B 'lure':48B 'mail':9A,63B 'mark':8A,64B,91C,158C 'mark-as-junk':90C,157C 'markasjunk':25B,97C 'messag':32B 'mode':119C 'packag':18B 'page':57B 'paramet':104C 'pass':109C,163C 'plugin':26B,98C,100C 'post':106C,167C 'queri':133C 'rcmail':112C 'rcube':164C 're':123C 're-read':122C 'read':30B,101C,124C 'request':7A 'roundcub':1A,19B,28B,72C 'self':21B 'self-host':20B 'skip':44B 'string':134C 'taken':130C 'token':41B,144C 'uid':33B,103C,114C 'upstream':145C 'user':53B,61B,69B 'util':165C 'valid':86C,142C,153C 'valu':121C 'way':36B 'webmail':2A,23B,29B,73C 'without':67B,115C,140C 'x':78C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Roundcube Webmail with the markasjunk plugin enabled, on versions before 1.6.20 or in the 1.7.x line before 1.7.5. Installations without the markasjunk plugin or on patched versions are not affected; hosted mail providers handle their own patching.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114719","severity":null,"published_at":"2026-10-22T02:16:59+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114719","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114719","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}