CVE-2026-62644

MEDIUM

Roundcube Webmail - Authentication Bypass by Spoofing

Title source: rule

Description

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

References (7)

Core 7

Core References

https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2

https://github.com/roundcube/roundcubemail/releases/tag/1.7.2

https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d

View Patch ZIP pw:eip

https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923

View Patch ZIP pw:eip

https://github.com/roundcube/roundcubemail/releases/tag/1.6.17

https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476

View Patch ZIP pw:eip

https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c

View Patch ZIP pw:eip

Scores

CVSS v3 6.4

EPSS 0.0026

EPSS Percentile 17.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-290

Status published

Products (3)

Roundcube/Webmail 1.6.0 - 1.6.17

roundcube/webmail 1.6.0 - 1.6.17

Roundcube/Webmail 1.7.0 - 1.7.2

Published Jul 14, 2026

Tracked Since Jul 14, 2026