---
id: "CVE-2026-114719"
kind: "vulnerability"
aliases: ["CVE-2026-114719"]
title: "Roundcube Webmail: CSRF bypass lets forged requests mark mail as junk"
severity: "low"
cvss: 3.7
epss: 0.00246
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "roundcube", "self-hosted", "webmail"]
not_affected_if: ["managed-hosting", "patched-version", "plugin-disabled"]
published_at: "2026-10-22T02:16:59+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:43:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114719", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114719", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Roundcube Webmail: CSRF bypass lets forged requests mark mail as junk

The markasjunk plugin in Roundcube Webmail reads the message UID in a way that lets the CSRF token check be skipped. An attacker who lures a logged-in user to a crafted page can get the user's mail marked as junk without the user's consent.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Roundcube version with `grep RCMAIL_VERSION program/include/iniset.php` or the version shown in the admin panel.
- Confirm the markasjunk plugin is enabled in `config/config.inc.php` under `$config['plugins']`.

## Fix

- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 line or `1.7.5` on the 1.7 line.
- Until upgraded, disable the markasjunk plugin if junk marking is not needed.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114719
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114719

## From the sources

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_