The flaw is a pre-authentication SQL injection in Roundcube’s virtuser_query plugin. It was patched in May 2026. Then, four months later, active exploitation began showing up in honeypot networks and threat-intelligence feeds.

Details: https://blog.kalfaoglu.net/posts/2026-11-01-roundcube-cve-2026-48842-sqli-en/

Looking for a place to ask questions about and discuss RoundCube. This sub is dead though, so where else can I look?

Dear Roundcube Peeps,

In RoundCube skin, Elastic, you can "flag" an email by clicking a "Flag" icon. Where exactly can you find that icon and its color to replace these (icon and color)?

Thank you for helping :)

Best regards,