Bug 2558700 (CVE-2026-114719)

Summary: CVE-2026-114719 roundcubemail: roundcubemail: CSRF validation bypass via markasjunk plugin
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Roundcube Webmail. A remote attacker could conduct a Cross-Site Request Forgery (CSRF) attack to alter email classifications without user consent. By enticing an authenticated user into following a malicious link, the attacker exploits improper parameter handling in the markasjunk plugin, which processes message identifiers from URL query strings without enforcing CSRF token checks. This allows the attacker to mark messages as junk on behalf of the victim.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2562381, 2562383    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-22 01:47:14 UTC 
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly.