CVE-2026-62644 is a medium severity (CVSS 6.4) flaw in the Roundcube password plugin. Username spoofing through session data could lead to account takeover. Roundcube fixed it in 1.6.17 and 1.7.2. If you use the password plugin, update to the newest release.
What's affected
- Roundcube Webmail before 1.6.17 on the 1.6 line. Fixed in 1.6.17.
- Roundcube Webmail 1.7.x before 1.7.2. Fixed in 1.7.2.
- Component: the
passwordplugin. - Weakness: CWE-290, authentication bypass by spoofing. CVSS 6.4 (medium), vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N.
How to check if you're exposed
Read the version from the Roundcube About dialog, or from the source tree.
grep -r "RCMAIL_VERSION" program/include/iniset.php
Anything before 1.6.17 on the 1.6 line, or before 1.7.2 on the 1.7 line, is in range. Check Docker images and distribution packages too, since those carry their own version numbers.
Then check whether the plugin is enabled. It is listed in the plugins array of your configuration:
grep -n "password" config/config.inc.php
If the password plugin is not enabled, this particular issue does not apply, but you should still update.
What to do now
- Find every Roundcube install and check whether the password plugin is enabled.
- Update to 1.6.17 or 1.7.2 at least. The Roundcube news page lists later security releases, so prefer the newest.
- If you cannot update yet, consider disabling the password plugin until you can.
- Review recent password change activity for accounts you did not expect to change.
Why it matters
The plugin changes a user's password, so it has to be sure which user is asking. The announcement says the plugin used a username injected into session data. If the username it acts on can be spoofed, one account's request can be turned against another's.
The score is medium because the vector requires a login and high complexity, with user interaction. Account takeover is still the outcome the record names. The record's KEV flag is false.
Quick check
Do I need the password plugin enabled for this to matter?
Yes. The flaw is in that plugin, so installs without it are not exposed to this issue.
Which versions fix it?
1.6.17 on the 1.6 line and 1.7.2 on the 1.7 line.
Sources
Last reviewed: 19 October 2026.
