CVE-2026-48847 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
mitre	CNA	3.7 LOW	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 34%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
roundcube	webmail	1.6.0 ≤ 𝑥 < 1.6.16	CNA
roundcube	webmail	1.7.0 ≤ 𝑥 < 1.7.1	CNA

Debian Releases

Debian Product

Codename

roundcube

bookworm	vulnerable
bookworm (security)	1.6.5+dfsg-1+deb12u9 fixed
bullseye	vulnerable
bullseye (security)	1.4.15+dfsg.1-1+deb11u9 fixed
forky	1.6.17+dfsg-1 fixed
sid	1.6.17+dfsg-1 fixed
trixie	vulnerable
trixie (security)	1.6.16+dfsg-0+deb13u1 fixed

Common Weakness Enumeration

CWE-669 - Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References

https://github.com/roundcube/roundcubemail/commit/703318e6a59515b73b0d8aa2a91e346b02f56baa

https://github.com/roundcube/roundcubemail/commit/a4eb375b98cc3d055de665c34efc729dd8ef272a

https://github.com/roundcube/roundcubemail/releases/tag/1.6.16

https://github.com/roundcube/roundcubemail/releases/tag/1.7.1

https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1