CVE-2024-42009: Roundcube Webmail cross-site scripting that can steal and send a victim's email
The short version: Roundcube Webmail has a cross-site scripting flaw (CVE-2024-42009) in its message rendering that, on merely viewing a crafted email, can read a victim's mail and send messages as them. It's XSS on paper but a mailbox takeover in effect — which is why it scores 9.3 and sits in CISA's KEV catalog. Patch and confirm. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 9.3 — Critical · AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
| EPSS | 84.45% · 99.67th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-06-30 |
| Known exploited? | Yes — listed as a known-exploited vulnerability |
| Vulnerability type | CWE-79 cross-site scripting (desanitization in message_body()) → mailbox read/exfiltrate/send |
| Requires authenticated session? | No for the attacker — a logged-in victim must open the crafted message (UI:R) |
| Affected | Roundcube through 1.5.7 and 1.6.x through 1.6.7 |
| Fixed in | 1.5.8 · 1.6.8 |
What you need to know
The flaw is a desanitization issue in message_body() in program/actions/mail/show.php. A crafted message defeats Roundcube's sanitization, so viewing it runs attacker script with the full reach of the victim's session.
- The impact is unusually high for XSS. This isn't just token theft — the payload can read the victim's mail and send email as them, which is why NVD marks both confidentiality and integrity High.
- Delivery is email. No prior access required; the attacker just needs the message opened.
- It's automatable and public, and it's in KEV — the combination that keeps EPSS near the top.
How serious we see it
High — and here the CVSS and our take agree closely.
Most webmail XSS is a Moderate that becomes dangerous through credential theft. This one is different: the base score is 9.3 because the flaw directly yields mailbox read and send. When "cross-site scripting" behaves like account takeover, we rate it by what it does. The bounded, reassuring part is the usual one — specific versions, a published patch (1.5.8 / 1.6.8), and a quick way to tell if it applies to you.
Recommendations
Straight from Roundcube's advisory and CISA:
- Patch now. Upgrade to 1.6.8 or 1.5.8 (or later).
- Enforce MFA on webmail — and be aware MFA doesn't stop an already-open session being abused, so patching is the real fix.
- Restrict exposure. Keep the Roundcube host reachable only where it must be.
- Hunt if you ran an affected build exposed. Look for unexpected sent mail, forwarding rules, or exfiltration from active mailboxes.
- Confirm your exposure first. Verify whether an internet-facing Roundcube instance exists and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Roundcube from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed vulnerabilities like this one — pushed to the top because it's actively exploited and its real impact reaches full-mailbox compromise, not just a stolen token. We identify and flag the affected version; we don't deliver the payload. The outside-in view means an exposed, unpatched Roundcube is already mapped when a bug like this lands.