What Happened
CVE-2026-48842 is a pre-authentication SQL injection flaw in virtuser_query, a built-in Roundcube plugin handling database-driven user lookups and mapping users to email addresses. An attacker needs no credentials and no interaction from a victim. A single crafted request against the plugin runs arbitrary database commands, exposing stored data and opening a path to further compromise of the mail server.
Roundcube fixed the flaw in May with versions 1.6.16 and 1.7.1. Exploitation began months later. The Canadian Centre for Cyber Security confirms active exploitation in advisory AV26-503, citing open-source reporting of attacks in the wild. Researchers count more than 523,000 Roundcube instances still reachable from the internet, and the number running a patched version remains unknown. Read the advisory from the Canadian Centre for Cyber Security and the technical writeup from BleepingComputer.
Why This Matters for Canadian Organizations
The Canadian Centre for Cyber Security rarely issues an advisory naming one specific open-source webmail plugin. Its direct involvement here signals real exposure inside Canada, not a general international warning passed along secondhand. Roundcube runs as the default webmail client on a large share of shared hosting plans, making it a common choice for small businesses, non-profits, municipalities, and universities self-hosting email on a budget instead of paying for a managed inbox.
A successful attack reaches the database mapping users to addresses, exposing account information tied directly to individuals. For any organization storing personal data behind an affected instance, this exposure creates a real risk of significant harm and triggers PIPEDA breach-reporting duties to the Office of the Privacy Commissioner. Municipal and university IT teams running self-hosted Roundcube face the same obligations under their provincial equivalents.
What to Do
Confirm whether any system in your organization runs Roundcube, including instances managed by a hosting provider on your behalf. Upgrade to 1.6.16 or 1.7.1 immediately. Where an upgrade needs more time, disable or remove the virtuser_query plugin as an interim step, and review database access logs for unusual queries against the user table. Ask hosting providers directly which Roundcube version sits behind your email, since a vendor patch released in May does not guarantee every hosted instance received it.
Track related vulnerability coverage in our TechTalk section and daily updates in News.
