CVE-2006-6701: Atmail Webmail

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail.

Affected products

• Atmail Atmail Webmail: version 3.0 only; version 4.0 only; version 4.51 only

Published 2006-12-23. Last modified 2026-06-16.