CVE-2026-114719
Description
A flaw was found in Roundcube Webmail. A remote attacker could conduct a Cross-Site Request Forgery (CSRF) attack to alter email classifications without user consent. By enticing an authenticated user into following a malicious link, the attacker exploits improper parameter handling in the markasjunk plugin, which processes message identifiers from URL query strings without enforcing CSRF token checks. This allows the attacker to mark messages as junk on behalf of the victim.
Statement
This vulnerability is evaluated with Moderate severity because exploitation requires social engineering to trick an authenticated user into visiting a malicious link, and the impact is confined to modifying junk mail flags rather than allowing arbitrary code execution or credential leakage. In Red Hat environments, Roundcube Webmail is not shipped in Red Hat Enterprise Linux core offerings and is only distributed through the Extra Packages for Enterprise Linux (EPEL) community repository. Furthermore, exploitation is only possible if the optional markasjunk plugin is enabled.
Mitigation
Update roundcubemail to 1.6.20 or 1.7.5 or later; disabling the markasjunk plugin mitigates this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
