Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a CSRF validation bypass vulnerability in the mark-as-junk action of the markasjunk plugin. This occurs because the plugin improperly handles the _uid parameter, allowing the action to be executed without a valid CSRF token. The issue has been fixed upstream by explicitly restricting input to POST data.