Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication

A highly severe vulnerability in Roundcube Webmail is being actively exploited, posing risks to unpatched email servers through unauthenticated SQL injection attacks.

This vulnerability, tracked as CVE-2026-48842, affects Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.

On September 21, the Canadian Center for Cyber Security updated advisory AV26-503, warning that reports from the open-source community have identified ongoing exploitation.

The advisory emphasizes that administrators apply Roundcube security updates without delay, especially for internet-facing deployments.

Vulnerability Details

CVE-2026-48842 is a pre-authentication SQL injection issue in Roundcube’s `virtuser_query` plugin. The vulnerability arises from a bypass in the plugin’s handling of backslash escaping via PHP’s `preg_replace()` function.

This allows attackers to manipulate a database query with crafted input before a user completes authentication.

Because this attack occurs before login, an attacker does not need valid mailbox credentials, passwords, session tokens, or any other account-level access. If the affected plugin is enabled and reachable, a remote attacker could send malicious input that gets executed in backend SQL operations.

The impact varies depending on the database configuration and the privileges assigned to the Roundcube database account.

Potential consequences include unauthorized access to sensitive records, modification or deletion of database content, authentication disruptions, and further compromise of the webmail environment.

SQL injection vulnerabilities are particularly dangerous in webmail platforms as they may expose user data, mailbox details, contacts, preferences, and application configurations.

Affected Versions

Product branch	Vulnerable versions	Fixed version
Roundcube Webmail 1.6.x	Earlier than 1.6.16	1.6.16 or later
Roundcube Webmail 1.7.x	Earlier than 1.7.1	1.7.1 or later

Roundcube released the fixed versions on May 24, 2026. Afterward, the Canadian Cyber Center confirmed that CVE-2026-48842 was under active exploitation, increasing the urgency of patching exposed systems.

Administrators should take the following immediate actions:

• Identify all Roundcube Webmail instances, including hosted, managed-service, and third-party deployments.
• Determine whether the virtuser_query plugin is enabled.
• Upgrade 1.6.x installations to version 1.6.16 or later, or 1.7.x installations to version 1.7.1 or later.
• Restrict public access to vulnerable Roundcube services until remediation is complete.
• Review web-server, Roundcube application, database, and authentication logs for anomalous requests, SQL errors, failed queries, or unexpected account activity.
• Verify that the Roundcube database user follows least-privilege principles and cannot perform unnecessary administrative operations.
• Preserve relevant logs and investigate unusual outbound connections or mailbox-access events as possible post-exploitation indicators.

Given the confirmed exploitation activity, this is more than a routine patching issue. Organizations with exposed Roundcube infrastructure should treat CVE-2026-48842 as an urgent remediation and threat-hunting priority.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC