Pre-auth SQL injection in Roundcube Webmail virtuser_query plugin
Pre-authentication SQL injection in Roundcube's virtuser_query plugin lets unauthenticated attackers bypass login and read or alter the webmail database. Now exploited in the wild.
- Vendor
- Roundcube
- Product
- Roundcube Webmail (before 1.6.16 / 1.7.1)
- CVSS
- 8.1
- EPSS (exploit probability)
- 0.9%
- Status
- exploited-in-wild
- Published
CVE-2026-48842 is a pre-authentication SQL injection flaw in the virtuser_query plugin shipped with Roundcube Webmail. The plugin maps virtual usernames to real mailbox accounts using database queries. An unauthenticated remote attacker can inject malicious SQL through that code path, bypassing the login screen and reading from or writing to Roundcube’s backend database.
Roundcube released patched versions 1.6.16 and 1.7.1 in May 2026. On September 24, 2026, the Canadian Centre for Cyber Security updated its original advisory to confirm active exploitation in the wild, citing open-source reporting. There is no CISA KEV entry as of this writing.
What to do: Upgrade to Roundcube 1.6.16 or 1.7.1. If immediate patching is not possible, disabling or removing the virtuser_query plugin eliminates the attack surface but will break virtual-user routing if your deployment relies on it. Verify the impact before disabling in production.
