Roundcube Webmail: Four Vulnerabilities Disclosed, Ranging from DoS to Account Takeover
Four Roundcube Webmail vulnerabilities disclosed, including denial of service, account takeover, and SSRF risks.
Key findings
- Four Roundcube Webmail vulnerabilities disclosed on July 15, 2026.
- Two DoS flaws in TNEF decoder (CVE-2026-62642, CVE-2026-62641).
- Account takeover risk via username spoofing in password plugin (CVE-2026-62644).
- SSRF and Information Disclosure due to insufficient CSS sanitization (CVE-2026-62643).
- Patched versions are 1.6.17 and 1.7.2.
On July 15, 2026, a batch of four vulnerabilities was disclosed for Roundcube Webmail, affecting versions prior to 1.6.17 and 1.7.x before 1.7.2. These vulnerabilities, detailed in a coordinated disclosure, present a range of risks including denial of service, account takeover, and server-side request forgery (SSRF).
Two of the vulnerabilities, CVE-2026-62642 and CVE-2026-62641, stem from issues within the TNEF decoder. CVE-2026-62642 describes an infinite loop vulnerability that could lead to a denial of service when processing emails with TNEF attachments. Similarly, CVE-2026-62641 details a denial of service vulnerability exploitable via a crafted compressed-RTF size within the TNEF decoder.
A more critical vulnerability, CVE-2026-62644, affects the password plugin. This flaw allows for username spoofing via session data, potentially leading to account takeover. This poses a significant risk to user accounts, allowing unauthorized access.
The fourth vulnerability, CVE-2026-62643, arises from insufficient Cascading Style Sheets (CSS) sanitization in HTML email messages. This can result in Server-Side Request Forgery (SSRF) or Information Disclosure. For instance, malicious actors could craft emails with stylesheet links pointing to local network hosts, enabling them to probe internal networks or exfiltrate sensitive information. This vulnerability is noted as a regression due to insufficient fixes for a previous CVE.
All reported vulnerabilities are addressed in Roundcube Webmail versions 1.6.17 and 1.7.2. Users are strongly advised to update to these patched versions to mitigate the risks associated with denial of service, account takeover, and SSRF attacks. The coordinated disclosure of these issues highlights the ongoing need for diligent security practices and timely patching of webmail clients.