Roundcube XSS chained with cookie tossing for full inbox access

The agents found a Stored Self-XSS vulnerability that could really only be exploited with Cookie Tossing. Scary for password reset tokens...