Roundcube Webmail SQL injection vulnerability exploited

Threat summary

On September 21, the Canadian Centre for Cyber Security updated advisory AV26-503 to report active exploitation of a Roundcube Webmail vulnerability originally disclosed and patched in May 2026.

Roundcube Webmail is an open-source webmail platform that provides browser-based access to email services. It is commonly deployed by organizations that operate their own email infrastructure and often contains access to email messages, address books, user accounts, and other communication data.

The flaw, tracked as CVE-2026-48842, affects Roundcube Webmail versions prior to 1.6.16 and 1.7.1. The vulnerability has a Common Vulnerability Scoring System (CVSS) v3.1 score of 8.1 and is rated High severity.

The vulnerability affects Roundcube's optional virtuser_query plugin, which performs a database lookup to map a user's email address to the corresponding mailbox account before authentication. A flaw in the way the plugin processes user-supplied input allows a threat actor to alter the database query used during that lookup process. Because this occurs before authentication, exploitation does not require valid credentials. The vulnerable virtuser_query plugin must be enabled for this attack path to be available.

Successful exploitation may allow a threat actor to interfere with database operations or access information available through the affected database queries. Depending on the deployment and the permissions assigned to the Roundcube application, this may expose user information, email-related data, address books, or other information stored within the mail environment.

Public reporting has not provided details on observed post-exploitation activity or the objectives of the threat actors involved.

Analysis

Roundcube has a long history of attracting threat actor attention because it provides access to one of an organization's most valuable assets: email.

Financial information, personal information, proprietary business data, contracts, customer records, internal communications, and strategic plans are routinely exchanged through email, making webmail platforms attractive targets for espionage, fraud, credential theft, and other intrusions.

Organizations operating internet-facing Roundcube deployments face the highest exposure, particularly when the virtuser_query plugin is enabled. Because the vulnerable functionality is reached before authentication, threat actors can attempt exploitation without valid credentials.

The impact depends on the deployment and the permissions assigned to Roundcube's database account. In environments where the application can access user information, address books, account details, or other email-related data, a successful attack could expose information that helps threat actors understand the organization and support follow-on operations.

Mitigations

Identifying Roundcube deployments, validating installed versions, and determining whether the optional virtuser_query plugin is enabled helps organizations assess exposure and prioritize remediation efforts. Upgrading affected systems to a fixed release (versions 1.6.16 and 1.7.1) removes the vulnerability.

Because the vulnerability exists in the virtuser_query plugin, organizations that do not require this functionality can consider disabling the plugin as a temporary risk-reduction measure until updates are applied. The suitability of this approach depends on how Roundcube is integrated with the organization's email infrastructure, as some environments rely on the plugin to map email addresses to backend mailbox accounts during authentication.

Reviewing web server, Roundcube application, authentication, and database logs may help identify unusual requests, unexpected database errors, or other activity that could indicate exploitation attempts. Internet-facing Roundcube deployments warrant particular attention, given the reported exploitation activity.

Additional hardening measures can reduce the impact of a compromise and improve visibility into suspicious activity:

• Restricting administrative access to trusted networks

• Implementing multi-factor authentication where supported

• Maintaining current backups

• Assigning only the database permissions required for Roundcube's operation

These measures can limit the information available to a threat actor and support recovery if an incident occurs.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up