Roundcube Penetration Testing
Roundcube sits between your users and your mail server, so its session and plugin settings are the access boundary. We test the configuration your team has actually set, not Roundcube’s underlying code. CREST-certified testers, fixed price from £2,840 for a 2-day single-instance scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
One file, config.inc.php, sets the mail server connection, the session encryption key, the installer state and every active plugin, and that file decides what a tester or an attacker can reach on your instance.
Why Roundcube risk sits in configuration and plugins, not the webmail client
Every Roundcube instance is governed by one configuration file, config.inc.php, which sets the database connection and the IMAP and SMTP hosts, and can be set to reuse a user’s own login as their SMTP credentials through the %u and %p placeholders. The same file carries a des_key value that Roundcube’s own sample configuration says must be exactly 24 characters and different from the sample value "for security reasons", because it encrypts every user’s mail password inside their session record. We test what your deployment actually has set in that file, not the vendor’s sample values.
Roundcube’s own defaults set a 10-minute session lifetime, store sessions server-side rather than only in the browser, and leave ip_check, which ties a session to the client IP that created it, switched off. The setup installer is disabled by default too, because leaving it enabled "can expose sensitive config data" in the vendor’s own words, and clickjacking protection defaults to same-origin framing rather than a stricter block. We test whether these defaults still hold on your instance or have been loosened for a specific plugin or workflow.
Roundcube’s plugin API adds its own configuration surface on top of the core defaults. The bundled managesieve plugin lets a user manage server-side mail filters over a connection whose authentication method and certificate checking are both optional settings rather than enforced, the acl plugin manages IMAP folder access under RFC 4314 for shared mailboxes, and the enigma plugin handles PGP and S/MIME keys that its own configuration requires to sit outside the web server’s document root. We test the plugins, filters and access controls your organisation has switched on, not the underlying application framework itself.
SCOPE
What we pen test on a Roundcube instance
IMAP-Backed Authentication and Auto-Provisioning
Roundcube authenticates every login directly against the configured IMAP server, with imap_auth_type and smtp_auth_type left to auto-negotiate the best method the server supports unless an administrator pins one, and a successful IMAP login can automatically create a new Roundcube account when auto_create_user is enabled. We test how your deployment negotiates authentication and whether auto-provisioning is scoped to logins your organisation actually expects.
Session Storage, Lifetime and Client IP Binding
A Roundcube session defaults to a 10-minute lifetime, stored server-side rather than only in a browser cookie, while ip_check, which ties a session to the client IP address that created it, is switched off by default. We test how your instance has these settings configured and whether a stolen session identifier is usable from a different network.
The des_key Session Encryption Secret
Roundcube encrypts each user’s IMAP password inside their session record using a des_key value that its own sample configuration says must be exactly 24 characters and must be changed from the sample value. We test whether your deployment is still running on a default or weak key and what a compromise of it would expose.
The Setup Installer and Configuration File Exposure
Roundcube’s own default configuration disables the setup installer specifically because leaving it enabled can expose sensitive configuration data, and the same config.inc.php file also holds the database DSN, SMTP credentials and the des_key. We test whether the installer has actually been removed or disabled and whether the configuration file itself is reachable over HTTP.
Managesieve Server-Side Mail Filters
The bundled managesieve plugin lets a user manage their own server-side Sieve filters, including a raw script editor enabled by default, over a connection whose authentication method and TLS certificate validation are both configurable per host rather than enforced. We test which hosts have managesieve enabled, how that connection authenticates, and what a filter rule can be made to do.
Shared Mailbox Access Control Lists
The bundled acl plugin manages IMAP folder access control lists under RFC 4314, letting a user grant another account rights such as read, write or admin on a shared mailbox folder. We test who has been granted access to shared folders in scope and whether an access grant still matches who should hold it.
PGP and S/MIME Message Encryption
The bundled enigma plugin handles PGP through a GnuPG driver and S/MIME through its own driver, and its own configuration requires the private key directory to sit outside the web server’s document root, alongside a configurable timeout for how long a decrypted key passphrase stays cached in the session. We test where private keys are actually stored and how long a cached passphrase remains usable after use.
Password-Change Backend and Stored Directory Credentials
The bundled password plugin changes a user’s mailbox password through a chosen backend, from a direct SQL query built with placeholders for the new and old password to an LDAP bind that can run in an admin mode using a stored directory account, and the plugin’s own documentation says access to that stored account should be restricted as far as possible in case it is compromised. We test which backend your deployment uses and how tightly that backend credential is scoped.
Alternate Login Methods: HTTP Auth, Kerberos and Autologon
Beyond the standard username and password form, Roundcube ships separate plugins for HTTP-based authentication passthrough, Kerberos authentication and encoded autologon links, each changing how a session first gets its trust. We test whichever of these your deployment has enabled for a way to establish or reuse a session outside the normal login form.
Skins, Plugin Output and Frame Embedding
The interface renders through a configurable skin and whatever active plugins add to it, with clickjacking protection set through x_frame_options, which defaults to same-origin framing rather than a stricter block. We test custom or third-party plugin output and skin templates for content that reaches the page without the same handling as the core client, and whether the frame-embedding default still matches your deployment’s needs.
OUR PROCESS
Roundcube Penetration Testing: From Scope to Attestation
Scope and Access
We agree which mailboxes, plugins such as managesieve, enigma, acl and password, and login methods are in scope, plus at least one standard IMAP account and an admin-level account or configuration file access if plugin and installer review is included.
Configuration and Plugin Mapping
We map config.inc.php and defaults.inc.php values against Roundcube’s own documented defaults for session handling, the installer and enabled plugins, then catalogue each active plugin’s own configuration, from managesieve’s connection settings to enigma’s key storage location.
Manual Testing
A CREST-certified tester manually tests session handling, authentication, mail filters, shared folder access control lists, PGP and S/MIME handling and password-change flows, chaining findings where they compound.
Report and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Roundcube pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Roundcube Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Roundcube For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Roundcube Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Roundcube instance?
We need at least one standard IMAP account that logs into Roundcube normally, and an admin-level account or read access to config.inc.php and defaults.inc.php if plugin and configuration review is in scope. If managesieve, enigma or the acl plugin are enabled we also ask for a second test account so filter, encryption and shared-folder access can be tested between two real users.
Will testing touch live mail data?
We test against the mailboxes and accounts you nominate, working with your real IMAP and SMTP configuration rather than a copy, so we agree exclusions such as production mail-filter changes or bulk message deletion before testing starts. We do not run destructive tests or alter live mail rules without that agreement in writing.
How long does a Roundcube penetration test take?
A single self-hosted Roundcube instance sits in our 2-day single-instance scope, with a report typically landing around 5 working days after kickoff. An instance with several active plugins, LDAP-backed password changes or Kolab-style shared filter sets in scope moves into a larger scope with more testing days.
Do you test self-hosted Roundcube the same way as a managed installation?
Yes. The testing questions, session handling, authentication, plugin configuration and mail filters, are the same whichever way Roundcube is hosted. What changes is the boundary: on infrastructure you manage yourself, the server, its file permissions and the installer’s presence are also in scope, while on a provider-managed installation we test to whatever boundary your hosting agreement sets.
What is out of scope for a single-instance Roundcube test?
The IMAP or SMTP mail server your Roundcube instance connects to, and any groupware platform such as Kolab that sits behind it, is a separate system and is scoped and quoted on its own. We test the Roundcube application, its configuration and its enabled plugins, not a connected mail server we did not build or configure for you.
Do you need our source code or server access?
No. Testing is black-box by default against the accounts you provide. A grey-box option, where we review config.inc.php, defaults.inc.php and the configuration of enabled plugins such as managesieve, enigma, acl and password, is available for faster or deeper coverage of specific findings.
Does Roundcube have a security disclosure policy we need to know about?
Roundcube’s own published security policy asks that vulnerabilities in the software be reported to its security team by encrypted email, with fixes typically issued within days of a confirmed report. That policy covers reporting a flaw in Roundcube’s own code to its developers, not authorisation to test your own deployment, so we confirm your current testing terms, and your hosting provider’s terms if applicable, during scoping.
Are your testers CREST certified?
Yes. Every Roundcube engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Roundcube instance
Roundcube sits between your users and your mail server, so its session and plugin settings are the access boundary. We test the configuration your team has actually set, not Roundcube’s underlying code. CREST-certified testers, fixed price from £2,840 for a 2-day single-instance scope, quoted within 24 hours.
