CVE-2026-61907

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user...

CVE-2026-61909

Cyrus IMAP versions before 3.12.4 are affected by a per-href ACL bypass in the CalDAV/CardDAV multiget functionality. An authenticated DAV user with some shared access to another user's calendar or address book can read unshared events or contacts by including the target hrefs in a calendar-multi...

CVE-2026-61915

Cyrus IMAP before 3.12.4 contains a VPATCH BYPARAM double-free vulnerability. An authenticated calendar user can crash a Cyrus CalDAV worker by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource that has two or more properties of the matched kind. The root cause is that th...

CVE-2026-61908

Cyrus IMAP before 3.12.4 (also patched in 3.8.8 and 3.10.4) is affected by an out-of-bounds read in its JMAP email-header blob ID handling. An authenticated user can craft a JMAP blob ID of the form H- referencing an index beyond the bounds of the internal blob_headers array , causing a read past...

CVE-2026-61907

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user...

EUVD-2026-75129

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired...

EUVD-2026-75132

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

EUVD-2026-75168

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

EUVD-2026-75134

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-61910

Cyrus IMAP versions before 3.12.4 are affected by an issue in the Mailbox/set command that allows an authenticated user holding the maySetKeywords permission on a shared mailbox to modify its specialuse annotation . This could reassign the mailbox to an archived, snoozed, or other special role, p...

CVE-2026-61911

Cyrus IMAP before 3.12.4 is affected by a Sieve mailbox existence oracle . An authenticated user can install a Sieve script that probes whether another user's private mailbox exists, or read the value of shared mailbox annotations , by observing which fileinto branch fires during LMTP delivery. T...

EUVD-2026-75139

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user...

EUVD-2026-75130

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...

Linux Distros Unpatched Vulnerability : CVE-2026-47086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token...

SUSE CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

SUSE CVE-2026-47089

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. This action should have been restricted ...

CVE-2026-47084

A flaw was found in Cyrus IMAP cyrus-imapd. An authenticated user, without administrative privileges, could bypass Access Control List ACL checks by using the LOCALDELETE command. This allowed them to delete mailboxes for which they did not have the necessary permissions, leading to unauthorized...

CVE-2026-47082

A flaw was found in Cyrus IMAP's cyrus-imapd component. A user with low privileges can exploit a vulnerability in the vacation "fcc" feature. By crafting a specific Sieve script, the user can bypass access control lists and deliver vacation auto-reply messages into any mailbox, leading to...

CVE-2026-47085

A flaw was found in Cyrus IMAP cyrus-imapd. A remote attacker could exploit a vulnerability related to URLAUTH token forgery, caused by a missing mailbox key. This could allow the attacker to gain unauthorized read access to a victim's mailbox. The likelihood of exploitation is low due to the...

CVE-2026-47088

A flaw was found in Cyrus IMAP Internet Message Access Protocol daemon, cyrus-imapd. An authenticated IMAP user could exploit a heap exposure vulnerability during nested Multipurpose Internet Mail Extensions MIME comment parsing. By crafting an email message with a specially formed RFC 822 commen...