CVE-2026-62644: Critical severity Roundcube Roundcube Webmail vulnerability
Published Jul 14, 2026
·Updated
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
Affected Software
3 affected components
Roundcube Roundcube Webmail<1.6.17, >1.6.17<=1.7.1
Roundcube Webmail>=1.6.0<1.6.17
Roundcube Webmail>=1.7.0<1.7.2
Remediation
Event History
Jul 14, 2026
CVE Published
via MITRE·03:55 PM
Data Sourced
via MITRE·03:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-62644?
The severity of CVE-2026-62644 is medium with a score of 6.4.
2
How do I fix CVE-2026-62644?
To fix CVE-2026-62644, update Roundcube Webmail to version 1.6.17 or 1.7.2 or later.
3
What type of attack does CVE-2026-62644 enable?
CVE-2026-62644 enables username spoofing attacks that can potentially lead to account takeover.
4
Which versions of Roundcube are affected by CVE-2026-62644?
CVE-2026-62644 affects Roundcube Webmail versions before 1.6.17 and 1.7.x before 1.7.2.
5
What are the potential impacts of CVE-2026-62644?
The potential impacts of CVE-2026-62644 include unauthorized access to user accounts due to session data manipulation.