External risk intelligence

Roundcube Webmail Username Spoofing Vulnerability Allows Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62644

Roundcube is a webmail application designed to be accessed over the internet for email management. As a public-facing web service intended for remote user access, it typically sits directly on the network edge or is exposed via a web server to provide functionality, making it inherently internet-facing in standard deployments.

Roundcube Webmail

1.6.0 to before 1.6.171.7.0 to before 1.7.2

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Roundcube Webmail, a widely used web-based email client. This issue allows for username spoofing, potentially leading to unauthorized account access and compromise. The primary concern is confirming if our environment utilizes the affected versions of this technology and understanding the scope of potential exposure.

A webmail flaw could expose user accounts.
Account takeover risk warrants leadership awareness.
Confirm relevance and exposure; assess business risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request to the Roundcube Webmail application, which has no authentication requirements to reach the vulnerable component. This could allow them to manipulate session data within the password plugin, potentially leading to unauthorized account access.

Accessible over the network.
Manipulate password plugin session data.
Account takeover.

Live Threat

Current exploitation, exposure, and threat context

An attacker could gain unauthorized access to user accounts by exploiting a username spoofing vulnerability in the password plugin. This could occur when the system is exposed to the internet and the affected versions of Roundcube Webmail are in use, potentially leading to account takeover.

User email accounts and data.
Via session data manipulation.
Unauthorized account access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical vulnerability in Roundcube Webmail. The first practical step is to identify all instances of the affected software, confirm their exposure and business criticality, and then coordinate with the vendor or internal teams for remediation.

Identify accountable application owners.
Verify internet-facing exposure and criticality.
Plan coordinated remediation with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Roundcube Webmail?

Roundcube is a browser-based email client written in PHP. It functions as a complete email management interface, allowing users to read, compose, and organize messages from any device. It is commonly deployed by organizations to provide web access to their private email servers.

How does CVE-2026-62644 facilitate account takeover?

This vulnerability relates to CWE-290, which involves an Authentication Bypass by Spoofing. In this case, the application's password plugin incorrectly processes session data. By manipulating this data, an unauthorized person can trick the system into misidentifying their account session, potentially granting them full control over another user's mailbox.

Do I need to be logged into Roundcube to trigger this flaw?

No. The vulnerability exists within the password plugin's handling of session data, which can be reached without providing valid credentials. Simply being a registered user is not a prerequisite for an attacker to attempt this manipulation against the software.

Is my instance of Roundcube Webmail at risk?

Halo Surface Signal indicates that Roundcube is typically deployed as a public-facing web service to support remote access. Because this application is inherently internet-facing, any instance running an affected version (1.6.x before 1.6.17 or 1.7.x before 1.7.2) is considered to have a high potential for external reachability.

What are the first steps to secure my Roundcube installation?

Begin by auditing your environment to locate all active Roundcube installations and checking their specific version numbers. Once you have identified vulnerable systems, prioritize them for updates to versions 1.6.17 or 1.7.2. Ensure that you coordinate this maintenance with your internal IT team to minimize disruption to your organization's email services.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.