by Kastro
Paper/Archive/CVE-2026-62644

CVE-2026-62644

Roundcube Webmail — In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing…

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.7.427 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

Affected

ProductAffectedFixed inSource
Webmail1.6.0 – < 1.6.171.6.17CNA
Webmail1.7.0 – < 1.7.21.7.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre (CNA)6.4CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refroundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2refgithub.com/roundcube/roundcubemail/releases/tag/1.7.2refgithub.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231drefgithub.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923refgithub.com/roundcube/roundcubemail/releases/tag/1.6.17refgithub.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476refgithub.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c