Zurück zur CVE-Übersicht
CVE-2026-62644
MEDIUM(6.4)CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Risk Signal Score26/100 — MITTEL
- CVSS 6.4 — Mittel
- Weniger als 24 Stunden alt
Beschreibung
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
Referenzen
- https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4...
- https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763...
- https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40a...
- https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960...
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
- https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2