What is the CVSS score of EUVD-2026-43751?

EUVD-2026-43751 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Roundcube Webmail are affected by EUVD-2026-43751?

Roundcube Webmail versions before 1.6.17 and 1.7.x before 1.7.2 are vulnerable to account takeover through the bundled password plugin, which fails to validate the authenticated user during password…. A patch is available.

How to fix or mitigate EUVD-2026-43751?

Within 24 hours: identify all Roundcube deployments running 1.6.x pre-1.6.17 or 1.7.x pre-1.7.2; if patching cannot be completed immediately, disable the password change feature in the web interface. Within 7 days: upgrade to Roundcube 1.6.17 (for 1.6.x installations) or 1.7.2 (for 1.7.x installations) and verify the patch version through deployment scanning. Within 30 days: audit email access logs for unauthorized password changes or anomalous account activity during the unpatched window and reset credentials for any accounts with suspicious activity.

Roundcube Webmail EUVD-2026-43751

| CVE-2026-62644 CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2026-07-14 mitre

GHSA-q4q9-gcgm-p77w

Authentication Bypass Roundcube Webmail Suse

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Medium–Critical)

Vendor (mitre) PRIMARY

MEDIUM

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable and low-complexity, but the session-data spoofing realistically requires a valid authenticated session (PR:L); account takeover gives full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 12:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 12:52 vuln.today

cvss_changed

Severity Changed

Jul 20, 2026 - 12:52 NVD

MEDIUM CRITICAL

CVSS changed

Jul 20, 2026 - 12:52 NVD

6.4 (MEDIUM) 9.8 (CRITICAL)

Patch available

Jul 14, 2026 - 18:20 EUVD

Source Code Evidence Fetched

Jul 14, 2026 - 16:36 vuln.today

Analysis Generated

Jul 14, 2026 - 16:36 vuln.today

DescriptionNVD

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

AnalysisAI

Account takeover in Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 stems from the bundled password plugin trusting a username injected into session data, allowing an attacker to spoof another account's identity when changing a password. The password plugin fails to bind the change operation to the authenticated user, so a spoofed username can redirect a password change to a victim's account. A vendor patch is available; SSVC rates technical impact as total but reports no observed exploitation, and EPSS is low at 0.24%, with no public exploit identified at time of analysis.

Technical ContextAI

Roundcube Webmail is a widely deployed PHP-based IMAP webmail client, and the affected component is its optional 'password' plugin, which lets end users change their mail account password through a configured backend driver (SQL, LDAP, IMAP, panel API, etc.). The root cause is CWE-290 (Authentication Bypass by Spoofing): the plugin derived the target username from session-injected data rather than strictly from the authenticated identity, so a manipulated username value flowing through session state was trusted as the account to modify. The affected CPE is cpe:2.3:a:roundcube:webmail across all editions, and the upstream fixes (commits 7414fef, 9a96c20, 83150ce, 5cdc6a4) tighten how the plugin resolves the username so it can no longer be overridden via session content.

RemediationAI

Apply the vendor-released patches: upgrade to Roundcube Webmail 1.6.17 (for the 1.6.x branch) or 1.7.2 (for the 1.7.x branch) as documented at https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2, backing up data before updating per the vendor's guidance. If you cannot patch immediately, the most effective compensating control is to disable the password plugin (remove it from the 'plugins' array in config) since the vulnerable code path lives entirely within it; the trade-off is that users lose the ability to self-service password changes and must use an out-of-band mechanism. As a secondary measure, restrict who can reach the settings/password interface (for example via reverse-proxy access controls or network segmentation) and monitor mail-backend password-change events for anomalies, accepting that this only narrows exposure rather than closing the spoofing flaw. These are stopgaps - upgrading to 1.6.17/1.7.2 is the only complete fix.