CVE-2009-4076: Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attack...

Security readout for executives and security teams

CVE-2009-4076 affects very old Roundcube Webmail versions, 0.2.2 and earlier. It is a CSRF issue where an attacker could trick a logged-in user into sending unintended requests that modify user information. The sources do not provide CVSS scoring, detailed vectors, or evidence of active exploitation. Exposure is most likely where legacy Roundcube Webmail 0.2.2 or earlier remains deployed, especially internet-facing webmail portals used by authenticated users. Treat as a cleanup priority for legacy internet-facing webmail. Urgency rises if Roundcube 0.2.2 or earlier is still in production, because unsupported webmail increases account and data risk even without confirmed active exploitation. Mitigation focus: Inventory Roundcube Webmail deployments and identify versions 0.2.2 or earlier.; Upgrade legacy Roundcube installations to a currently supported release per vendor guidance.; If immediate upgrade is impossible, restrict access to trusted networks and reduce exposure..

Prepared

Jun 28, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.