CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c	Patch
https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d	Patch
https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476	Patch
https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923	Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.6.17	Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.2	Release Notes
https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:roundcube:webmail::::::::
	cpe:2.3:a:roundcube:webmail::::::::

History

No history.

Information

Published : 2026-07-14 16:17

Updated : 2026-07-20 12:41

NVD link : CVE-2026-62644

Mitre link : CVE-2026-62644

CVE.ORG link : CVE-2026-62644

JSON object : View

Products Affected

roundcube

webmail

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-62644", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62644", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T17:13:58.999753Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Roundcube", "product": "Webmail", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "1.6.17", "versionType": "semver"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T16:17:04.810", "references": [{"url": "https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.17", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.2", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover."}], "lastModified": "2026-07-20T12:41:22.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE3CB576-6905-4ED7-AAD5-C0523B5E6FFD", "versionEndExcluding": "1.6.17", "versionStartIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58061F28-9D4F-4D65-8C64-F77410B6E144", "versionEndExcluding": "1.7.2", "versionStartIncluding": "1.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}