cyrusimap vulnerabilities

Newest CVEs

• CVE-2026-61915

  An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker…

  cyrusimap · Cyrus IMAP

  Medium4.2
• CVE-2026-61911

  An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed…

  cyrusimap · Cyrus IMAP

  Medium4.3
• CVE-2026-61910

  An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with…

  cyrusimap · Cyrus IMAP

  Low3.5
• CVE-2026-61909

  An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to…

  cyrusimap · Cyrus IMAP

  Low3.5
• CVE-2026-61908

  An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to…

  cyrusimap · Cyrus IMAP

  Low3.1
• CVE-2026-61907

  An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another…

  cyrusimap · Cyrus IMAP

  Medium4.3
• CVE-2026-47089

  An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call…

  cyrusimap · Cyrus IMAP

  Medium4.3
• CVE-2026-47088

  An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could…

  cyrusimap · Cyrus IMAP

  Low3.1
• CVE-2026-47087

  An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the…

  cyrusimap · Cyrus IMAP

  Low3.5
• CVE-2026-47086

  An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH…

  cyrusimap · Cyrus IMAP

  Low3.5