CVE-2026-114719 in Roundcube
Summary
by MITRE • 10/22/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified affects Roundcube Webmail versions prior to 1.6.20 and version series 1.7.x before 1.7.5, specifically within the functionality of the markasjunk plugin. This security flaw constitutes a Cross-Site Request Forgery validation bypass that allows an attacker to perform actions on behalf of authenticated users without their consent or knowledge. The core technical issue stems from improper input handling in the mark-as-junk action handler. When processing requests to flag emails as junk, the application reads the _uid parameter directly from POST data but fails to enforce strict input source constraints before passing it to the internal helper function rcmail::get_uids(). This lack of explicit validation creates a discrepancy between where the value is initially read and how it is subsequently processed by downstream functions.
The operational mechanism of this flaw relies on the behavior of the rcmail::get_uids() helper, which re-reads input parameters without restricting their source to POST data alone. Consequently, if an attacker crafts a request that includes the _uid parameter in the query string rather than strictly within the POST body, the application will accept and process these values as valid inputs for marking messages as junk. Because CSRF tokens are typically validated against the expected form submission context, which is usually tied to POST data, bypassing this check by supplying parameters via GET or mixed sources allows the action to proceed without a valid CSRF token. This effectively neutralizes one of the primary defenses against cross-site request forgery attacks in this specific module.
From an industry standards perspective, this vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF). The flaw represents a failure to properly validate input sources and enforce state-changing operations only through secure channels. In the context of the MITRE ATT&CK framework, this technique is relevant to T1076, known as Remote File Execution via Webmail, although more broadly it fits under techniques involving social engineering or automated exploitation where an attacker tricks a user into performing unintended actions. The specific bypass mechanism highlights weaknesses in input validation logic, which can also be associated with CWE-20: Improper Input Validation when the system fails to restrict data sources as intended by its security model.
The impact of this vulnerability is significant for organizations relying on Roundcube for email management. An attacker could create a malicious webpage or embed an image tag that triggers a request to the vulnerable endpoint, causing any logged-in user who visits the page to mark specific emails as junk without their explicit consent. This can lead to data loss if important messages are moved to spam folders and potentially missed by users. Furthermore, it undermines trust in the webmail interface's security posture and could be leveraged in broader attack chains where disrupting communication channels is a strategic objective.
To mitigate this risk, administrators must upgrade Roundcube Webmail to version 1.6.20 or later if running the legacy branch, or to version 1.7.5 or later for the current development line. The upstream fix explicitly addresses the issue by ensuring that rcube_utils::INPUT_POST is passed when retrieving user IDs, thereby enforcing strict source validation and preventing query string parameters from being used in this context. Until an upgrade can be performed, organizations should consider implementing web application firewall rules to block requests containing suspicious patterns associated with CSRF bypass attempts targeting the markasjunk plugin endpoint. Regular security audits of custom plugins and adherence to secure coding practices that mandate explicit input type verification are recommended to prevent similar vulnerabilities in other modules.