MDaemon Webmail (formerly WorldClient) has CSRF.
https://www.altn.com/Software/MDaemon-Webmail-WorldClient/
https://packetstormsecurity.com/files/cve/CVE-2018-17792
http://packetstormsecurity.com/files/153686/WorldClient-14-Cross-Site-Request-Forgery.html