Pre-auth SQL injection in Roundcube Webmail virtuser_query plugin
Pre-authentication SQL injection in Roundcube's virtuser_query plugin lets unauthenticated attackers bypass login and read or alter the webmail database. Now exploited in the wild.
- Vendor
- Roundcube
- Product
- Roundcube Webmail (before 1.6.16 / 1.7.1)
- CVSS
- 8.1
- EPSS (exploit probability)
- 1.7%
- Status
- exploited-in-wild
- Published
Is CVE-2026-48842 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-48842 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.7% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-48842 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-48842 is a pre-authentication SQL injection flaw in the virtuser_query plugin shipped with Roundcube Webmail. The plugin maps virtual usernames to real mailbox accounts using database queries. An unauthenticated remote attacker can inject malicious SQL through that code path, bypassing the login screen and reading from or writing to Roundcube’s backend database.
Roundcube released patched versions 1.6.16 and 1.7.1 in May 2026. On September 24, 2026, the Canadian Centre for Cyber Security updated its original advisory to confirm active exploitation in the wild, citing open-source reporting. There is no CISA KEV entry as of this writing.
What to do: Upgrade to Roundcube 1.6.16 or 1.7.1. If immediate patching is not possible, disabling or removing the virtuser_query plugin eliminates the attack surface but will break virtual-user routing if your deployment relies on it. Verify the impact before disabling in production.
Other Roundcube Webmail CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2025-68461 RoundCube Webmail Cross-site Scripting Vulnerability | [ HIGH ] | 7.2 | 27.4% | |
| CVE-2025-49113 Roundcube post-auth RCE via PHP object deserialization in upload handlerwrite-up | [ CRITICAL ] | 9.9 | 99.6% | |
| CVE-2024-42009 Roundcube stored XSS via crafted email runs attacker JavaScript in mailboxwrite-up | [ CRITICAL ] | 9.3 | 82.9% | |
| CVE-2024-37383 RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 74.0% | |
| CVE-2020-13965 Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 76.6% | |
| CVE-2023-43770 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 63.7% | |
| CVE-2023-5631 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 76.3% | |
| CVE-2021-44026 Roundcube Webmail SQL Injection Vulnerability | [ CRITICAL ] | 9.8 | 69.9% |
