Roundcube Webmail is vulnerable to a CSRF validation bypass in the mark‑as‑junk action of the markasjunk plugin. The plugin accepts the _uid parameter from POST data and forwards it to rcmail::get_uids() without limiting the input mode, allowing values that were originally part of the query string to be interpreted during the operation. This missing CSRF check enables an attacker to force an authenticated user to mark selected messages as junk without authorization, resulting in misleading mailbox organization. The weakness aligns with CWE‑346 (Missing Default) and CWE‑352 (Cross‑Site Request Forgery).

Roundcube Webmail versions before 1.6.20 and before 1.7.5 are affected. The vulnerability applies to all Roundcube Webmail instances using these release lines.

The CVSS score of 3.7 indicates low severity. The EPSS score is < 1%, showing a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based, requiring a malicious site or compromised user to trigger a forged POST request within the victim’s session. The impact is limited to misleading mailbox organization, with no direct escalation to broader system compromise.