A pre-authentication SQL injection flaw in Roundcube Webmail, tracked as CVE-2026-48842 and rated CVSS 8.1, is reportedly being exploited in the wild. The vulnerability affects the virtuser_query plugin, which performs database-backed mappings between usernames and email addresses. Roundcube attributed the issue to a preg_replace() backslash-escape bypass that can allow attacker-controlled input to influence SQL queries. It was fixed on 24 May 2026 in versions 1.6.16 and 1.7.1.
The Canadian Centre for Cyber Security updated its advisory on 21 September to say open-source reporting indicated exploitation, although details about attackers, victims and attack activity remain unconfirmed.
Only Roundcube 1.6.x versions before 1.6.16 and 1.7.x versions before 1.7.1 are listed as affected; Roundcube 1.5.x is not identified as vulnerable. Exposure generally requires the virtuser_query plugin to be explicitly enabled, vulnerable functionality to be reachable and the application’s database account to have useful privileges. Successful attacks could permit unauthorised SQL operations, with possible exposure, modification or disruption of database data.
The flaw does not by itself establish operating-system-level remote code execution or access to mailbox contents, as those outcomes depend on the deployment and database configuration.
Administrators should upgrade to at least the relevant fixed version, preferably a later supported release such as 1.6.19 or 1.7.4, both published on 6 September 2026. They should verify the running version, check whether virtuser_query is enabled, disable it if unnecessary, and enforce least-privilege database permissions.
Systems exposed after 24 May should also be reviewed through web, PHP, Roundcube and database logs for suspicious unauthenticated requests, database activity, configuration changes or abnormal sessions. These are investigation leads rather than confirmed indicators of compromise.