Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication
Unauthenticated SQL injection CVE-2026-48842 in Roundcube Webmail is being actively exploited on unpatched servers.
CVE-2026-48842 is an unauthenticated SQL injection in Roundcube Webmail’s virtuser_query plugin, caused by a bypass of backslash escaping in PHP preg_replace handling. It affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1; fixed versions were released on May 24, 2026. On September 21 the Canadian Centre for Cyber Security updated advisory AV26-503 to say open-source community reports show ongoing exploitation. A remote attacker can manipulate backend SQL before login, with impact depending on database privileges, so internet-facing servers should be patched and hunted immediately.
- CVE-2026-48842 is pre-authentication SQL injection in the virtuser_query plugin.
- Vulnerable releases are 1.6.x before 1.6.16 and 1.7.x before 1.7.1.
- Fixes shipped May 24, 2026; Canada now warns of ongoing exploitation.
- Exposed admins should patch, limit access, and review logs for SQL abuse.
- CVEs
- CVE-2026-48842
- Vendors
- Roundcube
- Products
- Roundcube Webmail
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-48842 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash… | 8.1 | 2% | PoC ×3 |
From the original article
2 min read at gbhackers.com
A highly severe vulnerability in Roundcube Webmail is being actively exploited, posing risks to unpatched email servers through unauthenticated SQL injection attacks. This vulnerability, tracked as CVE-2026-48842, affects Roundcube Webmail versions 1. 6.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.