What is the CVSS score of CVE-2026-48842?

CVE-2026-48842 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Roundcube Webmail are affected by CVE-2026-48842?

Roundcube Webmail deployments running versions 1.6.x (prior to 1.6.16) and 1.7.x (prior to 1.7.1) contain an unauthenticated SQL injection vulnerability that bypasses login controls and grants direct…. A patch is available.

How to fix or mitigate CVE-2026-48842?

Within 24 hours: Inventory all Roundcube Webmail instances and identify those running versions 1.6.x prior to 1.6.16 or 1.7.x prior to 1.7.1; restrict network access to unpatched systems if immediate patching is not feasible. Within 7 days: Upgrade all 1.6.x deployments to version 1.6.16 and all 1.7.x deployments to version 1.7.1; test functionality post-patch in non-production environment first. Within 30 days: Verify patch deployment across all Roundcube instances, review database access logs for exploitation attempts, and validate integrity of user accounts and email data.

Roundcube Webmail CVE-2026-48842

EUVD-2026-31719 HIGH

SQL Injection (CWE-89)

2026-05-25 mitre

GHSA-vc2v-cxrw-6g4p

SQLi Webmail

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 10:31 vuln.today

Analysis Generated

Jun 08, 2026 - 10:31 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

AnalysisAI

Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to bypass input sanitization through a preg_replace() backslash escape flaw and inject arbitrary SQL against the backing database. Versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1 are affected. Vendor patches are available, no public exploit identified at time of analysis, and EPSS is low (0.08%), but SSVC rates technical impact as total.

Technical ContextAI

Roundcube Webmail is a widely deployed PHP-based browser webmail client. The virtuser_query plugin maps email addresses to mailbox accounts by issuing SQL queries against a configured database, with input intended to be neutralized via PHP's preg_replace(). The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a backslash-escape bypass in the preg_replace() routine permits attacker-controlled input to break out of the intended quoting context, so untrusted address strings reach the SQL statement unsanitized. CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* covers all Roundcube Webmail installations regardless of OS or distribution packaging.

RemediationAI

Upgrade to Roundcube Webmail 1.6.16 or 1.7.1 - vendor-released patches that contain the fix commits 87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b (1.6.16) and 3406183a9976e36f992d3468f37d0e2346526ee9 (1.7.1), published in the security advisory at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 and the release notes at https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.1. Where immediate upgrade is not feasible, disable the virtuser_query plugin in config/config.inc.php by removing it from the $config['plugins'] array - this fully removes the vulnerable code path but breaks any virtual-user address-to-mailbox mapping that depends on it, so sites relying on virtuser_query for multi-domain mail routing should use the database-backed virtuser_file alternative or accelerate the upgrade. Additional defense-in-depth includes restricting database user privileges granted to the Roundcube account to only the tables and operations it requires, and placing the webmail behind a WAF tuned to flag SQL metacharacters on login-related endpoints - noting that WAF rules may produce false positives on legitimate addresses containing special characters.