Executive brief
Roundcube Webmail, a popular open-source web-based email client, contains a security flaw in its password management plugin. An attacker could potentially manipulate session data to spoof a different user's identity, leading to unauthorized account access. This could allow a malicious actor to take over email accounts, compromising sensitive communications and personal data.
Technical details
A vulnerability exists in the password plugin of Roundcube Webmail (versions before 1.6.17 and 1.7.x before 1.7.2) classified as authentication bypass by spoofing (CWE-290). The root cause is the improper handling of session-injected usernames within the plugin's drivers (such as LDAP and DirectAdmin). An attacker with low-privileged access could potentially manipulate session data to spoof a different username during password operations. This flaw can be exploited over the network, though it requires high complexity and user interaction, to achieve account takeover. The issue has been addressed in versions 1.6.17 and 1.7.2 by ensuring the username is correctly passed and validated through the save function and driver substitutes.
Affected products
- Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2
Timeline
- 2026-07-05: patched: Security updates 1.6.17 and 1.7.2 released
- 2026-07-14: disclosed: CVE-2026-62644 published
References
- https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c
- https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d
- https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476
- https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
- https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2