CVE-2026-114719

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114719", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-22T01:28:45.178Z", "datePublished": "2026-10-22T01:28:45.516Z", "dateUpdated": "2026-11-02T15:54:43.963Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit \u201cFix CSRF validation bypass in the mark-as-junk action\u201d, which passes rcube_utils::INPUT_POST explicitly."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-22T01:28:45.516Z"}, "references": [{"tags": ["issue-tracking", "third-party-advisory"], "url": "https://bugs.debian.org/1151279"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/6ea2bbe356099c9da98eabcfeafd8d6aa2d67b3d"}, {"tags": ["vendor-advisory", "release-notes"], "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.6.0", "versionEndExcluding": "1.6.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.0", "versionEndExcluding": "1.7.5"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T15:54:31.826562Z", "id": "CVE-2026-114719", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:54:43.963Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114719", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T15:54:31.826562Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:54:38.667Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "product": "Webmail", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "1.6.20", "versionType": "semver"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.debian.org/1151279", "tags": ["issue-tracking", "third-party-advisory"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/6ea2bbe356099c9da98eabcfeafd8d6aa2d67b3d", "tags": ["patch"]}, {"url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5", "tags": ["vendor-advisory", "release-notes"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5", "tags": ["release-notes", "patch"]}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20", "tags": ["release-notes", "patch"]}, {"url": "https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81", "tags": ["patch"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit \u201cFix CSRF validation bypass in the mark-as-junk action\u201d, which passes rcube_utils::INPUT_POST explicitly."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.6.20", "versionStartIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.7.5", "versionStartIncluding": "1.7.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-22T01:28:45.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114719", "state": "PUBLISHED", "dateUpdated": "2026-11-02T15:54:43.963Z", "dateReserved": "2026-10-22T01:28:45.178Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-22T01:28:45.516Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "D91A1C10-A81F-420B-9DE2-078A9BBA469D", "versionEndExcluding": "1.6.20", "versionStartIncluding": "1.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "D41F4166-D4C5-4D1C-94AC-3CF3C27F1319", "versionEndExcluding": "1.7.5", "versionStartIncluding": "1.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit \u201cFix CSRF validation bypass in the mark-as-junk action\u201d, which passes rcube_utils::INPUT_POST explicitly."}], "id": "CVE-2026-114719", "lastModified": "2026-11-02T16:17:27.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114719", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T15:54:31.826562Z", "version": "2.0.3"}}]}, "published": "2026-10-22T02:16:59.570", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://bugs.debian.org/1151279"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/roundcube/roundcubemail/commit/6ea2bbe356099c9da98eabcfeafd8d6aa2d67b3d"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "roundcubemail: roundcubemail: CSRF validation bypass via markasjunk plugin", "id": "2558700", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558700"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit \u201cFix CSRF validation bypass in the mark-as-junk action\u201d, which passes rcube_utils::INPUT_POST explicitly.", "A flaw was found in Roundcube Webmail. A remote attacker could conduct a Cross-Site Request Forgery (CSRF) attack to alter email classifications without user consent. By enticing an authenticated user into following a malicious link, the attacker exploits improper parameter handling in the markasjunk plugin, which processes message identifiers from URL query strings without enforcing CSRF token checks. This allows the attacker to mark messages as junk on behalf of the victim."], "mitigation": {"lang": "en:us", "value": "Update roundcubemail to 1.6.20 or 1.7.5 or later; disabling the markasjunk plugin mitigates this issue."}, "name": "CVE-2026-114719", "public_date": "2026-10-22T01:28:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114719\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114719\nhttps://bugs.debian.org/1151279\nhttps://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81\nhttps://github.com/roundcube/roundcubemail/commit/6ea2bbe356099c9da98eabcfeafd8d6aa2d67b3d\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.20\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.5\nhttps://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "statement": "This vulnerability is evaluated with Moderate severity because exploitation requires social engineering to trick an authenticated user into visiting a malicious link, and the impact is confined to modifying junk mail flags rather than allowing arbitrary code execution or credential leakage. In Red Hat environments, Roundcube Webmail is not shipped in Red Hat Enterprise Linux core offerings and is only distributed through the Extra Packages for Enterprise Linux (EPEL) community repository. Furthermore, exploitation is only possible if the optional markasjunk plugin is enabled.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.0,1.6.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.0,1.7.5)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Webmail", "source": "cna", "vendor": "Roundcube"}, "product": "webmail", "vendor": "roundcube"}], "created": "2026-10-22T06:30:17.852918+00:00", "updated": "2026-10-30T15:00:15.298877+00:00", "vendors": ["roundcube", "roundcube$PRODUCT$webmail"]}