CriticalFix available
roundcube — security advisory
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
- Products
- roundcube
- Affected versions
- 1.6.1+dfsg-1, 1.6.11+dfsg-1, 1.6.12+dfsg-0+deb13u1, 1.6.12+dfsg-1, 1.6.13+dfsg-0+deb13u1, 1.6.13+dfsg-1, 1.6.14+dfsg-1, 1.6.15+dfsg-0+deb13u1, 1.6.15+dfsg-1, 1.6.16+dfsg-0+deb13u1, 1.6.16+dfsg-1, 1.6.2+dfsg-1, 1.6.3+dfsg-1, 1.6.3+dfsg-1~deb12u1, 1.6.3+dfsg-2, 1.6.4+dfsg-1, 1.6.4+dfsg-1~deb12u1, 1.6.5+dfsg-1, 1.6.5+dfsg-1+deb12u2, 1.6.5+dfsg-1+deb12u3, 1.6.5+dfsg-1+deb12u4, 1.6.5+dfsg-1+deb12u5, 1.6.5+dfsg-1+deb12u6, 1.6.5+dfsg-1+deb12u7, 1.6.5+dfsg-1+deb12u8, 1.6.5+dfsg-1+deb12u9, 1.6.5+dfsg-1~deb12u1
- Fixed versions
- 1.6.17+dfsg-0+deb13u1, 1.6.17+dfsg-1, 1.6.5+dfsg-1+deb12u10
- CVEs
- CVE-2026-62644
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:53 UTC · Revision 2
Source evidence
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
osv:DEBIAN-CVE-2026-62644
roundcube
Fixed versions: 1.6.5+dfsg-1+deb12u10
roundcube
Fixed versions: 1.6.17+dfsg-0+deb13u1
roundcube
Fixed versions: 1.6.17+dfsg-1
Complete source record
{
"id": "f30b01be519e36eb2c3e07d21d029b8d74a9f9ceb1560824e17e9d18d95a47ae",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-62644",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-62644",
"summary": "In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.",
"evidence": "osv:DEBIAN-CVE-2026-62644",
"products": [
{
"name": {
"value": "roundcube",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.5+dfsg-1+deb12u10",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "1.6.1+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.2+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.3+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.3+dfsg-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.3+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.4+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.4+dfsg-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u6",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u7",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u8",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u9",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1~deb12u1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.17+dfsg-0+deb13u1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "1.6.11+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.12+dfsg-0+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.12+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.13+dfsg-0+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.13+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.14+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.15+dfsg-0+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.15+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.16+dfsg-0+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.16+dfsg-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.17+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "1.6.11+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.12+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.13+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.14+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.15+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.16+dfsg-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2026-62644",
"aliases": [
"DEBIAN-CVE-2026-62644"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.5+dfsg-1+deb12u10"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.6.1+dfsg-1",
"1.6.2+dfsg-1",
"1.6.3+dfsg-1",
"1.6.3+dfsg-1~deb12u1",
"1.6.3+dfsg-2",
"1.6.4+dfsg-1",
"1.6.4+dfsg-1~deb12u1",
"1.6.5+dfsg-1",
"1.6.5+dfsg-1+deb12u2",
"1.6.5+dfsg-1+deb12u3",
"1.6.5+dfsg-1+deb12u4",
"1.6.5+dfsg-1+deb12u5",
"1.6.5+dfsg-1+deb12u6",
"1.6.5+dfsg-1+deb12u7",
"1.6.5+dfsg-1+deb12u8",
"1.6.5+dfsg-1+deb12u9",
"1.6.5+dfsg-1~deb12u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62644.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.17+dfsg-0+deb13u1"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.6.11+dfsg-1",
"1.6.12+dfsg-0+deb13u1",
"1.6.12+dfsg-1",
"1.6.13+dfsg-0+deb13u1",
"1.6.13+dfsg-1",
"1.6.14+dfsg-1",
"1.6.15+dfsg-0+deb13u1",
"1.6.15+dfsg-1",
"1.6.16+dfsg-0+deb13u1",
"1.6.16+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62644.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.17+dfsg-1"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.6.11+dfsg-1",
"1.6.12+dfsg-1",
"1.6.13+dfsg-1",
"1.6.14+dfsg-1",
"1.6.15+dfsg-1",
"1.6.16+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62644.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-25T09:47:31.627007678Z",
"provider": "osv",
"upstream": [
"CVE-2026-62644"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-62644"
]
},
"related_cves": [
{
"value": "CVE-2026-62644",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 445190,
"published_at": "2026-07-14T16:17:04.81+00:00"
}