CVE-2020-12626

An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.

• CWE-352

• https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/pull/7302Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.4.4Third Party Advisory
• https://security.gentoo.org/glsa/202007-41Third Party Advisory
• https://www.debian.org/security/2020/dsa-4674Third Party Advisory
• https://github.com/roundcube/roundcubemail/commit/9bbda422ff0b782b81de59c86994f1a5fd93f8e6Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/pull/7302Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.4.4Third Party Advisory
• https://security.gentoo.org/glsa/202007-41Third Party Advisory
• https://www.debian.org/security/2020/dsa-4674Third Party Advisory

Published

May 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12619MailMate before 1.11 automatically imported S/MIME certifica…5.9
• CVE-2020-1262An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-12620Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-s…7.8
• CVE-2020-12621The Teamwire application 5.3.0 for Android allows physically…6.1
• CVE-2020-12624The League application before 2020-05-02 on Android sends a …6.5
• CVE-2020-12625An issue was discovered in Roundcube Webmail before 1.4.4. T…6.1
• CVE-2020-12627Calibre-Web 0.6.6 allows authentication bypass because of th…9.8
• CVE-2020-12629include/class.sla.php in osTicket before 1.14.2 allows XSS v…5.4
• CVE-2020-1263An information disclosure vulnerability exists in the way Wi…5.5
• CVE-2020-12635XSS exists in the WebForms Pro M2 extension before 2.9.17 fo…6.1
• CVE-2020-12637Zulip Desktop before 5.2.0 has Missing SSL Certificate Valid…9.8
• CVE-2020-12638An encryption-bypass issue was discovered on Espressif ESP-I…6.8