CSRF Validation Bypass in Roundcube Webmail Mark-as-Junk Action

CVE-2026-114719

What is CVE-2026-114719?

Roundcube Webmail versions prior to 1.6.20 and 1.7.5 are susceptible to a CSRF validation bypass within the mark-as-junk action of the markasjunk plugin. This vulnerability arises because the plugin processes the '_uid' parameter from the POST data without adequate input constraints, allowing attackers to execute actions without a valid CSRF token. Consequently, user requests could be manipulated using improperly validated input, resulting in potential unauthorized actions. Roundcube has issued security updates to rectify this issue, ensuring input validation is properly enforced.

References