CVE-2024-42009

This vulnerability lets an attacker hide malicious instructions inside an email. If a user who’s already logged into Roundcube opens that email, the attacker’s code can run in the browser—allowing them to take over the webmail session and send emails as the victim.

This matters if you run RoundCube Webmail and your version is in the affected range (1.5.7 and 1.6.x through 1.6.7). Attacks don’t work against people who aren’t already logged in to Roundcube, but the victim does need to open the attacker’s email in the Roundcube inbox.

Because CISA KEV confirms active exploitation, treat this as a risk wherever the webmail is reachable and users receive attacker-controlled messages.

This is RED because it is confirmed exploited in the real world (listed in CISA KEV, with reported incidents). The attacker can steal a logged-in user’s session and send emails on their behalf, so successful phishing can directly impact accounts and communications.