Roundcube Webmail CVE-2026-114719

Exploitation requires that the target Roundcube instance has the markasjunk plugin enabled and that the victim holds an active, authenticated webmail session at the moment the forged request is delivered; the attacker must also induce the victim to trigger the cross-site request. The flaw works because the plugin read _uid from POST but passed it to rcmail::get_uids() without constraining the input mode, letting the value be re-read from the query string and the action proceed without a valid CSRF token. Limiting factors: dependency on the markasjunk plugin being active, the need for a live authenticated session plus victim interaction, high attack complexity, and an impact confined to marking messages as junk (no data disclosure, code execution, or availability loss). Affected: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5.

This is a low-severity issue in practice, consistent with its CVSS 3.1 base score of 3.7. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N indicates network reach and no attacker privileges, but high attack complexity and an impact limited to integrity-low (C:N/A:N) - the only outcome is marking a victim's messages as junk without a valid CSRF token. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' A notable inconsistency: the supplied vector sets UI:N, yet this is a CWE-352 CSRF flaw (confirmed by the vendor commit title and CSRF tag), which inherently depends on tricking an already-authenticated victim into issuing a request - meaning real exploitation does require user interaction and an active session, making UI:N questionable; verify with the vendor. Taken together, the signals point to a genuine-but-minor hardening fix rather than an urgent priority: no confidentiality or availability exposure, no exploitation evidence, and a constrained, low-value action as the worst case.

An attacker lures a currently-authenticated Roundcube user (whose instance runs the markasjunk plugin) to a malicious page that auto-submits a forged request; because the plugin re-read the message _uid outside POST, the mark-as-junk action executes without a valid CSRF token. The result is that the victim's targeted messages are silently moved to/flagged as junk. No public exploit code is identified, and the high attack complexity plus required active session limit real-world impact.