Roundcube Webmail versions 1.6.0 and 1.7.0 contain a pre-authentication SQL injection vulnerability in the virtuser_query plugin. The issue arises due to improper neutralization of special elements in SQL commands, specifically through a preg_replace() backslash escape bypass. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full compromise of the system. The vulnerability is tracked as CVE-2026-48842 with a CVSS 3.1 score of 8.1, indicating high severity. No patch or official remediation level has been documented yet.

Successful exploitation of this vulnerability can result in unauthorized access to the database, allowing attackers to read, modify, or delete sensitive data. It can also lead to full system compromise affecting confidentiality, integrity, and availability. Since the vulnerability is pre-authentication, it can be exploited without valid credentials, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the virtuser_query plugin if feasible or restrict access to the Roundcube Webmail interface to trusted networks. Monitor vendor channels for updates and apply patches promptly once available.