1.0 Introduction
Recently, Roundcube has released security
updates to address a high-severity pre-authentication SQL injection
vulnerability (CVE-2026-48842) in Roundcube Webmail.
2.0 Impact
Successful exploitation of this vulnerability
in the virtuser_query plugin may allow an unauthenticated remote attacker to
inject arbitrary SQL statements into the underlying database. This may expose
mail account credentials and stored messages. The attack is only possible when
the optional virtuser_query plugin is enabled.
3.0 Affected Products
- Roundcube Webmail versions 1.6.0 to before 1.6.16
- Roundcube Webmail versions 1.7.0 to before 1.7.1
4.0 Recommendations
CyberSecurity
Malaysia encourages users and administrators to review the Roundcube security
update announcement and update to version 1.6.16 or 1.7.1 (or later) as soon as
possible, especially on internet-facing servers. Administrators should check
whether the virtuser_query plugin is enabled. As additional hardening, they
should give the Roundcube database account only the permissions it needs, which
does not fix the flaw but may limit the impact of an attack.
Kindly refer to the following URL:
Generally, we advise users to be updated with
the latest security announcements by the vendor and follow best practice
security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References