CVE-2026-62644
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.4epss 0.3%
probabilidad de explotación
0.3%top 83% de las CVE
explotación observada
noninguna fuente lo reporta
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Productos afectados
Roundcube · WebmailReferencias
https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4chttps://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231dhttps://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923https://github.com/roundcube/roundcubemail/releases/tag/1.6.17https://github.com/roundcube/roundcubemail/releases/tag/1.7.2https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2