CVE-2016-4069 — Cross-Site Request Forgery in Webmail

CWE-352 — Cross-Site Request Forgery10 documents7 sources
Severity
8.8HIGHNVD
OSV6.1
EPSS
1.1%
top 21.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Roundcube WebmailRoundcube WebmailOpensuse Leap
Timeline
PublishedAug 25
Latest updateMar 30

Description

Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶Ubunturoundcube/roundcube_webmail< 1.2~beta+dfsg.1-0ubuntu1+esm7+1
▶NVDopensuse/leap42.1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
roundcube vulnerabilities↗2026-03-30
▶
GHSA
GHSA-c625-ghm3-xfc2: Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1↗2022-05-14
▶
CVEList
CVE-2016-4069: Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1↗2016-08-25
▶
OSV
CVE-2016-4069: Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1↗2016-08-25
▶

📋Vendor Advisories

2
Ubuntu
Roundcube Webmail vulnerabilities↗2026-03-30
▶
Debian
CVE-2016-4069: roundcube - Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1....↗2016
▶

💬Community

3
Bugzilla
CVE-2015-2181 CVE-2015-8864 CVE-2016-4068 CVE-2016-4069 roundcubemail: security issues fixed in version 1.0.9 [fedora-all]↗2016-04-25
▶
Bugzilla
CVE-2015-2181 CVE-2015-8864 CVE-2016-4068 CVE-2016-4069 roundcubemail: security issues fixed in version 1.0.9↗2016-04-25
▶
Bugzilla
CVE-2015-2181 CVE-2015-8864 CVE-2016-4068 CVE-2016-4069 roundcubemail: security issues fixed in version 1.0.9 [epel-all]↗2016-04-25
▶
CVE-2016-4069 — Cross-Site Request Forgery in Webmail | cvebase