DSA-6391-1 roundcube - security update
Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in account takeover, cross-site scripting, SSRF bypass, information disclosure or denial of service. https://security-tracker.debian.org/tracker/DSA-6391-1
CSIRTS triage
- What
- Multiple vulnerabilities could result in account takeover, cross-site scripting, SSRF bypass, information disclosure, or denial of service.
- Who is affected
- Deployments of the roundcube webmail solution.
- Urgency
- Remediation is urgent as these vulnerabilities could lead to significant security breaches.
- Action
- Apply the security update provided in DSA-6391-1.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch roundcube
Get an email when a new roundcube advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00302.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-544320.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
- Low exploitation riskCVE-2026-544330.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all scored CVEs.
- Low exploitation riskCVE-2026-626410.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
- Low exploitation riskCVE-2026-626420.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
- Low exploitation riskCVE-2026-626430.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all scored CVEs.
- Low exploitation riskCVE-2026-626440.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-54432 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54433 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62641 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62642 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62643 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62644 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] Roundcube: Multiple vulnerabilitiescert-bund
- highCVE-2026-54433: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scriptin…nvd
- mediumCVE-2026-54432: Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS…nvd
- mediumCVE-2026-62644: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcub…nvd
- highCVE-2026-62643: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets…nvd
- mediumCVE-2026-62642: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in …nvd
- mediumCVE-2026-62641: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to den…nvd
- unknownMultiple vulnerabilities in Roundcube (July 6, 2026)cert-fr-avis
More from Debian Security Advisories
- unknownDSA-6409-1 libgd2 - security update2026-08-01
- unknownDSA-6408-1 chromium - security update2026-07-31
- unknownDSA-6406-1 php8.4 - security update2026-07-31
- unknownDSA-6405-1 linux - security update2026-07-31
- unknownDSA-6407-1 incus - security update2026-07-31