diff --git a/CHANGELOG b/CHANGELOG
index 6e10a25d7..6dfb1fc73 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,7 @@ CHANGELOG Roundcube Webmail
 - Fix PHP 7.2 compatibility in debug_logger plugin (#6586)
 - Fix so ANY record is not used for email domain validation, use A, MX, CNAME, AAAA instead (#6581)
 - Fix so mime_content_type check in Installer uses files that should always be available (i.e. from program/resources) (#6599)
+- Fix missing CSRF token on a link to download too-big message part (#6621)
 
 RELEASE 1.3.8
 -------------