CVE Feed
3.7 Low

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk…

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcubeutils::INPUTPOST explicitly.

Assessment

CVSS
3.7 (v3.1)
Severity
Low
EPSS
0.22% chance of exploitation in the next 30 days
Known exploited
Not listed in CISA KEV
Exploit availability
Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
Published
22 October 2026
Last updated
2 November 2026
Affected
Roundcube · Webmail
Assigner
mitre

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

At the source

References

Community proofs of concept

No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.

Submit a proof of concept

Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.

Before you submit *

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2026-114719