Pre-authentication SQL injection in Roundcube Webmail virtuser_query plugin (CVE-2026-48842)
The Canadian Centre for Cyber Security updated its advisory on 2026-09-21 to report exploitation, with BleepingComputer and SecurityWeek amplifying it this week; installations that skipped the May updates and use virtuser_query are exposed to unauthenticated database compromise.
A preg_replace() backslash escape bypass in Roundcube's virtuser_query plugin allows SQL injection before login, giving an unauthenticated attacker read/write access to the webmail database (accounts, identities, session data) on installations that use that plugin. Fixed in 1.6.16 and 1.7.1, released 2026-05-24.
Affected: Roundcube Webmail 1.6.0 through 1.6.15; Roundcube Webmail 1.7.0
How to Test
Confirm the installed Roundcube version is below 1.6.16 (1.6 LTS) or below 1.7.1 (1.7), and check whether the virtuser_query plugin is enabled in your configuration — only those deployments are reachable by this bug. Review webmail access logs and login records for pre-auth login attempts whose username/email fields contain backslashes or SQL syntax, and audit the users and identities tables for unexpected entries.
How to Patch
Upgrade to Roundcube 1.6.16 or 1.7.1 (or the current 1.6.19 / 1.7.4). If the upgrade must wait, disable the virtuser_query plugin until it is applied.