Shared Hosting and CVE-2026-48842: When One Mail Server Holds Every Tenant

Vulnerability overview

CVE-2026-48842 is a pre-authentication SQL injection in the Roundcube Webmail virtuser_query plugin, fixed on 24 May 2026 in releases 1.6.16 and 1.7.1. Roundcube names the mechanism as a preg_replace backslash escape bypass and credits skull. A secondary record rates it CVSS 8.1 (CVSSv3), class CWE-89, and reports that the Canadian Centre for Cyber Security confirmed exploitation in the wild. The flaw matters most where many tenants share one webmail application and one database account.

Mechanism and exploitation conditions

The plugin answers identity questions before login. It takes a value supplied by the client, filters it with a regular expression substitution, and queries the directory that maps addresses to mailboxes. Crafted backslash sequences survive that substitution, so the query carries attacker-chosen SQL and runs without credentials or user interaction.
Two conditions decide whether a host is at risk: virtuser_query active, and the webmail endpoint reachable from outside. On a shared platform both usually hold, because the business model is to serve many mail domains from one application.

Impact

The database account used by the webmail application defines the blast radius, and on shared hosting that account typically reaches every tenant's mail records. Reported outcomes are extraction of sensitive email records and compromise of the database layer. A single unauthenticated injection therefore crosses the isolation boundary that customers were promised, and the data at risk includes password-reset mail, invoices and business correspondence belonging to parties with no relationship to the attacker.

Affected products and scope

Reported affected releases are 1.6.x before 1.6.16 and 1.7.x before 1.7.1, limited to installations with virtuser_query in use. The same 24 May 2026 release also fixed a stored XSS and CSS injection in the draft restore dialog subject field, a CSS injection bypass in the HTML sanitizer via an SVG animate attribute, an SSRF bypass through specific local address URLs, a local or private URL fetch bypass, a remote image blocking bypass via CSS var(), a pre-auth arbitrary file delete reached through redis or memcache session poisoning, and code injection via the LDAP autovalues option.

Exposure context

ZoomEye readings on 2026-09-24 recorded 650127 matches for app="Roundcube Webmail", 534256 for title="Roundcube", 773507 for http.body="Roundcube" and 4334 for ssl="roundcube". The query vul.cve="CVE-2026-48842" returned 0, which says something about indexing rather than about exposed hosts. These are fingerprint matches, not a count of vulnerable servers, and none of them distinguishes a single-tenant install from a host serving thousands of mailboxes.

Remediation and mitigations

Patch to 1.6.16 or 1.7.1 or later and confirm the running version. Split the database privileges so the webmail application holds no more than it needs; on shared platforms this usually means per-tenant or per-service accounts rather than one broad grant. Disable virtuser_query where virtual user mapping is not required. If a provider cannot upgrade immediately, limiting the webmail endpoint to known addresses reduces the audience, but the flaw remains until the code changes.
For providers, the honest version of this work includes customer communication. A pre-auth database flaw on a multi-tenant mail platform is a reportable incident under several regimes, and the technical response is only part of it. Log retention across the exposure window matters, because pre-auth exploitation leaves no authentication trail to reconstruct after the fact.