Pre-authentication SQL Injection Vulnerability in Roundcube Webmail by Roundcube
CVE-2026-48842

8.1HIGH

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
25 May 2026

Badges

📈 Trended📈 Score: 3,900💰 Ransomware👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-48842?

CVE-2026-48842 is a security vulnerability found in Roundcube Webmail, an open-source webmail software used widely for email management. The flaw exists specifically in the virtuser_query plugin and is characterized as a pre-authentication SQL injection vulnerability. When exploited, this vulnerability allows an attacker to manipulate SQL queries in a way that can compromise the database without needing to authenticate. This poses a significant security risk as it could lead to unauthorized access to sensitive data, data integrity issues, and even complete compromise of the webmail application. The versions affected are Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x before 1.7.1.

Potential Impact of CVE-2026-48842

  1. Unauthorized Database Access: The SQL injection vulnerability permits attackers to execute arbitrary SQL commands, potentially allowing them to extract sensitive user information or even alter data without needing valid credentials.

  2. Data Integrity Compromise: By manipulating SQL queries, an attacker can insert, update, or delete records in the database, leading to corrupted data and loss of trustworthiness in the webmail service.

  3. Wider System Compromise: Given the nature of SQL injection vulnerabilities, successful exploitation could serve as a stepping stone for further attacks on the server, leading to broader network access, including the potential installation of malicious software or ransomware campaigns.

Affected Version(s)

Webmail 1.6.0 < 1.6.16

Webmail 1.7.0 < 1.7.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-48842
Created by 4minx

News Articles

favicon imageInternational Business Times

Roundcube Flaw CVE-2026-48842 Is Now Exploited: Patch 1.6.16 or 1.7.1 to Update

Roundcube CVE-2026-48842 is being exploited in the wild. Check your version and virtuser_query plugin, then update to at least 1.6.16 or 1.7.1.

2 weeks ago

favicon imageIt Security News

Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild - IT Security News

Vendors can use your data to provide services. Declining a vendor can stop them from using the data you shared.Exponential Interactive, Inc d/b/a VDX.tvCookie duration: 90 (days).Data collected and processed:...

2 weeks ago

favicon imageWebpronews

Critical Roundcube Webmail RCE Vulnerability CVE-2026-48842 Actively Exploited

Attackers are exploiting a critical unpatched vulnerability (CVE-2026-48842) in Roundcube webmail servers, enabling remote code execution via crafted emails without authentication. The flaw affects older versions and has been used to deploy web shells, steal data, and launch ransomware. Organization...

2 weeks ago

References

https://roundcube.net/news/2026/05/24/security-updates-1....
https://github.com/roundcube/roundcubemail/releases/tag/1...
https://github.com/roundcube/roundcubemail/commit/3406183...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 📈

    Vulnerability started trending

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.