Roundcube Webmail versions 1.6.0 and 1.7.0 contain a vulnerability classified as CWE-669 (Incorrect Resource Transfer Between Spheres) that permits pre-authentication arbitrary file deletion. This is achieved through session poisoning bypassing redis or memcache session stores. The issue affects versions prior to 1.6.16 and 1.7.1. The CVSS 3.1 base score is 3.7, reflecting a low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited availability impact. No vendor advisory or patch links are currently available.

The vulnerability allows an unauthenticated attacker to delete files arbitrarily on the affected Roundcube Webmail server, potentially causing limited denial of service or availability disruption. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting access to redis/memcache session stores and applying network-level controls to limit exposure.