OPENSUSE-SU-2026:21368-1 Security update for cyrus-imapd

This update for cyrus-imapd fixes the following issues: Changes in cyrus-imapd: - Update to 3.8.7 bugfix release - CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack bsc1271617 - CVE-2026-47083: ESEARCH cross-user content oracle bsc1271619 - CVE-2026-47082: Vacation "fcc"...

SUSE CVE-2026-47089

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. This action should have been restricted ...

CVE-2026-47089

A flaw was found in Cyrus IMAP cyrus-imapd. An authenticated user can exploit this vulnerability by using the IMAP LISTRIGHTS command. This allows the user to learn the access permissions of any mailbox they can name, which should be restricted to administrators. This leads to unauthorized...

Linux Distros Unpatched Vulnerability : CVE-2026-47089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP...

CVE-2026-47089

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. This action should have been restricted ...

CVE-2026-47089

CVE-2026-47089 affects Cyrus IMAPD up to version 3.12.2. The LISTRIGHTS function is not restricted to admins, allowing any authenticated user to call LISTRIGHTS on a mailbox they name and discover which principals have what access. This is a data-exposure/privacy issue tied to insufficient access...