CVE-2026-48842 is a high-severity SQL injection vulnerability affecting Roundcube Webmail. Specifically, versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1 are vulnerable due to improper sanitization in the virtuser_query plugin. The issue arises from a preg_replace() backslash escape bypass that enables an attacker to inject SQL commands before authentication. This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). No official patch or remediation level is currently provided in the available data.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database. This can lead to compromise of confidentiality, integrity, and availability of the affected system, including unauthorized data access, modification, or deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated in the provided data, users should monitor Roundcube's official channels for updates. Until a patch is available, consider disabling or restricting access to the virtuser_query plugin if feasible to reduce exposure.