What is the CVSS score of EUVD-2026-43751?

EUVD-2026-43751 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-43751?

Yes, a patch is available for EUVD-2026-43751. Update the affected software to the latest version immediately.

Roundcube Webmail EUVD-2026-43751

| CVE-2026-62644 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-07-14 mitre

GHSA-q4q9-gcgm-p77w

Authentication Bypass Webmail

6.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

6.4 MEDIUM

Network-reachable attack (AV:N) requires an authenticated session (PR:L), specific session manipulation conditions (AC:H), and user interaction (UI:R); successful exploitation yields full account takeover (C:H, I:H) with no availability impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 14, 2026 - 18:20 EUVD

Source Code Evidence Fetched

Jul 14, 2026 - 16:36 vuln.today

Analysis Generated

Jul 14, 2026 - 16:36 vuln.today

DescriptionCVE.org

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

AnalysisAI

Username spoofing via session data in Roundcube Webmail's password plugin allows an authenticated attacker to manipulate session state so that the plugin operates on a victim's account rather than the attacker's own, enabling password changes on the target account and full account takeover. All 1.6.x versions prior to 1.6.17 and all 1.7.x versions prior to 1.7.2 are affected when the password plugin is enabled. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Roundcube with valid credentials

Delivery

Inject victim username into session data

Exploit

Trigger password plugin change workflow

Execution

Plugin processes spoofed session username

Persist

Set new password on victim account

Impact

Authenticate to victim mailbox with attacker-controlled credentials

Access

Authenticate to Roundcube with valid credentials

Delivery

Inject victim username into session data

Exploit

Trigger password plugin change workflow

Execution

Plugin processes spoofed session username

Persist

Set new password on victim account

Impact

Authenticate to victim mailbox with attacker-controlled credentials

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following: (1) the Roundcube password plugin must be explicitly enabled in the installation - it is not universally active by default and varies by hosting configuration; (2) the attacker must hold a valid, authenticated Roundcube session (CVSS PR:L); (3) user interaction is required per CVSS UI:R - the specific nature of this interaction is not detailed in available public data, but it may refer to a victim-side or attacker-side action needed to trigger the plugin; (4) attack complexity is high (AC:H), indicating specific session state conditions that must be met before the spoofed username is accepted. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The published CVSS 3.1 vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N scores 6.4 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Roundcube user injects a victim's username into the session data consumed by the password plugin, then triggers the password change workflow. The plugin, trusting session data over the authenticated principal, sets a new password on the victim's account rather than the attacker's. …
Remediation	Upgrade to Roundcube Webmail 1.6.17 for 1.6.x deployments, or to 1.7.2 for 1.7.x deployments, per the vendor security announcement at https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2; the vendor explicitly recommends backing up data before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.