CVE-2026-62644 Overview
CVE-2026-62644 is a username spoofing vulnerability in the Roundcube Webmail password plugin. The flaw affects Roundcube Webmail before version 1.6.17 and 1.7.x before 1.7.2. Attackers can manipulate session data used by the password plugin to spoof usernames, enabling account takeover of other Roundcube users. The weakness is classified under CWE-290: Authentication Bypass by Spoofing. Roundcube is a widely deployed open-source IMAP webmail client used by hosting providers and enterprises, which broadens the potential attack surface.
Critical Impact
An attacker can spoof the username value stored in session data used by the password plugin to change credentials belonging to another account, resulting in full account takeover.
Affected Products
- Roundcube Webmail versions prior to 1.6.17
- Roundcube Webmail 1.7.x versions prior to 1.7.2
- Password plugin drivers including ldap, ldap_simple, directadmin, and dovecot_passwdfile
Discovery Timeline
- 2026-07-05 - Roundcube releases security updates 1.6.17 and 1.7.2
- 2026-07-14 - CVE-2026-62644 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-62644
Vulnerability Analysis
The Roundcube password plugin reads the target username from $_SESSION['username'] when constructing password change requests to backend drivers such as LDAP, DirectAdmin, and Dovecot. The plugin trusts this session value as the account whose password will be modified. Because the session value can be influenced through the password change flow, an authenticated attacker can cause the plugin to operate against a different account than the one associated with the current authenticated session. The result is credential modification against another user, followed by account takeover through the standard login flow.
Root Cause
The root cause is reliance on a session-injected username field rather than the authenticated user identity returned by the framework. Drivers such as ldap_simple.php, directadmin.php, and dovecot_passwdfile.php read $_SESSION['username'] directly and substitute it into LDAP DNs, HTTP requests, and password-file lookups. The upstream fix replaces this pattern with the authenticated user obtained from rcmail::get_instance()->get_user_name() or a username parameter passed explicitly into each save() implementation.
Attack Vector
The vulnerability is exploitable over the network without user interaction against any Roundcube deployment exposing the password plugin. An authenticated attacker submits a crafted password change request that causes the plugin to act on a spoofed username. Depending on the backend driver, the attacker can rewrite an LDAP userDN, invoke a DirectAdmin password change for a different account, or overwrite a Dovecot passwd file entry. Once the target account's password is changed, the attacker authenticates as the victim.
// Patch: plugins/password/drivers/directadmin.php
// Username is now passed as a parameter rather than pulled from $_SESSION
class rcube_directadmin_password
{
- public function save($curpass, $passwd)
+ public function save($curpass, $passwd, $username)
{
$rcmail = rcmail::get_instance();
- $da_user = $_SESSION['username'];
$da_curpass = $curpass;
$da_newpass = $passwd;
- if (!str_contains($da_user, '@')) {
+ if (!str_contains($username, '@')) {
return ['code' => PASSWORD_ERROR, 'message' => 'Change the SYSTEM user password through control panel!'];
}
Source: Roundcube commit 7414fef
// Patch: plugins/password/drivers/dovecot_passwdfile.php
// Session username replaced with authenticated user from rcmail
private static function expand_config_value(string $subject): string
{
+ $rcmail = rcmail::get_instance();
+
return strtr($subject, [
'%l' => self::get_username_part_idn_aware('local'),
'%d' => self::get_username_part_idn_aware('domain'),
- '%u' => $_SESSION['username'],
+ '%u' => $rcmail->get_user_name(),
]);
}
Source: Roundcube commit 7414fef
Detection Methods for CVE-2026-62644
Indicators of Compromise
- Password change requests in Roundcube logs (logs/errors.log, logs/userlogins) where the target username differs from the authenticated session owner.
- Unexpected LDAP modify operations targeting userDN values that do not match the requesting user account.
- DirectAdmin API CMD_API_USER_PASSWD calls originating from Roundcube for accounts other than the caller.
- Modifications to Dovecot passwd files or virtual user tables not correlated with legitimate self-service password change activity.
Detection Strategies
- Audit Roundcube password plugin activity and correlate the session user with the account whose credentials were changed; any mismatch is suspicious.
- Deploy a web application firewall rule to flag _task=settings&_action=plugin.password-save requests that include unexpected username or login parameters.
- Monitor LDAP directory servers for password modification operations that do not originate from the account owner's authenticated identity.
Monitoring Recommendations
- Enable Roundcube verbose logging (log_driver and per_user_logging) to capture password plugin invocations with full context.
- Forward Roundcube, LDAP, and mail backend logs to a centralized analytics platform for cross-source correlation.
- Alert on successful logins immediately following a password change from a different source IP or user agent.
How to Mitigate CVE-2026-62644
Immediate Actions Required
- Upgrade Roundcube Webmail to 1.6.17 or 1.7.2 without delay.
- If the password plugin is not required, disable it in config/config.inc.php by removing password from the plugins array.
- Rotate credentials for any account that shows unexplained password changes since the vulnerable version was deployed.
- Review Roundcube session and password plugin logs for anomalous activity dating back to the installation of an affected release.
Patch Information
Roundcube published fixes on 2026-07-05 in Roundcube Release 1.6.17 and Roundcube Release 1.7.2. The corrective commits are 5cdc6a4, 7414fef, 83150ce, and 9a96c20. See the Roundcube Security Updates Announcement for the full advisory.
Workarounds
- Disable the password plugin in Roundcube configuration until patches can be applied.
- Restrict access to /?_task=settings behind an authenticated reverse proxy or IP allowlist for administrative users only.
- Enforce out-of-band password change workflows through the mail hosting control panel, bypassing the vulnerable Roundcube plugin.
# Disable the Roundcube password plugin as a temporary workaround
# Edit config/config.inc.php and remove 'password' from the plugins array
sed -i "s/'password',//g" /var/www/roundcube/config/config.inc.php
# Verify the plugin is no longer loaded
grep -n "plugins" /var/www/roundcube/config/config.inc.php
# Restart the web server to apply changes
systemctl reload php-fpm && systemctl reload nginx
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
