CVE-2026-62644 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
mitre	CNA	6.4 MEDIUM	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
roundcube	webmail	1.6.0 ≤ 𝑥 < 1.6.17	CNA
roundcube	webmail	1.7.0 ≤ 𝑥 < 1.7.2	CNA

Common Weakness Enumeration

CWE-290 - Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.

Vulnerability Media Exposure

[GERMAN] Roundcube: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Roundcube ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Denial-of-Service-Angriffe zu verursachen, Cross-Site-Scripting-Angriffe durchzuführen sowie Daten zu manipulieren oder offenzulegen.
Published: 2026-07-05T22:00:00+00:00

References

https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c

https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d

https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476

https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923

https://github.com/roundcube/roundcubemail/releases/tag/1.6.17

https://github.com/roundcube/roundcubemail/releases/tag/1.7.2

https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2