If you are running OWASP CRS you can disable the global rule IDs 981176 and 949110.
Or add the following to your whitelist before the rules load:
SecRule REQUEST_URI "@contains /roundcube/" "id:{some number},phase:1,nolog,allow"
SecRule REQUEST_URI "@contains /roundcubemail-*/" "id:{some number},phase:1,nolog,allow"
Also if you send files you might have to disable certain file extension rules.