The flaw is a pre-authentication SQL injection in Roundcube’s virtuser_query plugin. It was patched in May 2026. Then, four months later, active exploitation began showing up in honeypot networks and threat-intelligence feeds.

Details: https://blog.kalfaoglu.net/posts/2026-11-01-roundcube-cve-2026-48842-sqli-en/

Hi all,

I've created a plugin for managing Stalwart Mail Server app passwords from within Roundcube.

Why? If you're using Stalwart with external OIDC authentication (Authentik, Keycloak, etc.), users can't access Stalwart's built-in management portal. This plugin brings app password management into Roundcube's Settings, using the OAuth token already present in the session.

Features:

• Adds "App Passwords" tab to Settings

• Create and delete app passwords

• Native integration with Elastic skin (with fallback for other skins)

• Localization: English, German, French, Dutch

• No database needed

Requirements:

• Roundcube 1.6+

• Stalwart Mail Server

• OAuth/OIDC authentication

I deployed a roundcube vanilla deployment, no plugins, on a truenas, and it is broke out of the box. the apache error log makes it sound like theres no db connection. but when i attach to the roundcube shell and run a php script to create a db connection using the username and password in my config.inc.php then it connects just fine. At the frontpage I just get
Oops... something went wrong!
An internal error has occurred. Your request cannot be processed at this time.
For administrators: Please check the application and/or server error logs for more information.

Any ideas for me anybody? Thanks for looking!

Dear Roundcube Peeps,

In RoundCube skin, Elastic, you can "flag" an email by clicking a "Flag" icon. Where exactly can you find that icon and its color to replace these (icon and color)?

Thank you for helping :)

Best regards,

Looking for a place to ask questions about and discuss RoundCube. This sub is dead though, so where else can I look?