CVE-2026-62644

EUVD-2026-43751
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 40.54%
Affected Products (NVD)
VendorProductVersion
roundcubewebmail
1.6.0 ≤
𝑥
< 1.6.17
roundcubewebmail
1.7.0 ≤
𝑥
< 1.7.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
roundcube
bookworm
vulnerable
bookworm (security)
1.6.5+dfsg-1+deb12u10
fixed
bullseye
vulnerable
bullseye (security)
1.4.15+dfsg.1-1+deb11u10
fixed
forky
1.6.18+dfsg-1
fixed
sid
1.6.18+dfsg-1
fixed
trixie
vulnerable
trixie (security)
1.6.17+dfsg-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
roundcube
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c
https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d
https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476
https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923
https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2