Cyrusimap

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Cyrusimap product.

RSS Feeds for Cyrusimap security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Cyrusimap products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Cyrusimap Sorted by Most Security Vulnerabilities since 2018

Cyrusimap Cyrus Imap10 vulnerabilities

Cyrusimap Cyrus Sasl3 vulnerabilities

By the Year

In 2026 there have been 9 vulnerabilities in Cyrusimap with an average score of 4.2 out of ten. Cyrusimap did not have any published security vulnerabilities last year. That is, 9 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	9	4.19
2025	0	0.00
2024	1	6.50
2023	0	0.00
2022	1	8.80
2021	0	0.00
2020	0	0.00
2019	1	0.00

It may take a day or so for new Cyrusimap vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Cyrusimap Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-47082	Jul 16, 2026	Cyrus IMAP 3.12.2: Vacation Fcc ACL Bypass in Sieve Script An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.	Cyrus Imap
CVE-2026-47083	Jul 16, 2026	ESEARCH cross-user content oracle in cyrus-imapd through 3.12.2 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).	Cyrus Imap
CVE-2026-47084	Jul 16, 2026	Cyrus IMAP 3.12.2 LOCALDELETE ACL Bypass An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.	Cyrus Imap
CVE-2026-47085	Jul 16, 2026	Cyrus IMAP 3.12.2 URLAUTH Token Forgery via mboxkey An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)	Cyrus Imap
CVE-2026-47086	Jul 16, 2026	Cyrus IMAP URLAUTH Token Bypass ACL in v3.12.2 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.	Cyrus Imap
CVE-2026-47087	Jul 16, 2026	URLAUTH Revoked Authorizer Access Not Honored in cyrus-imapd 3.12.2 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.	Cyrus Imap
CVE-2026-47088	Jul 16, 2026	Cyrus IMAP (cyrus-imapd) 3.12.2 Heap Leak via MIME Comment An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.	Cyrus Imap
CVE-2026-47089	Jul 16, 2026	Cyrus IMAP 3.12.2 LISTRIGHTS: Unauthorized access control flaw An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)	Cyrus Imap
CVE-2026-47081	Jul 16, 2026	Cyrus IMAP 3.12.2 XAPPLEPUSHSERVICE Push Hijack Vulnerability An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.	Cyrus Imap
CVE-2024-34055	Jun 05, 2024	Cyrus IMAP Auth Attack Causing Unbounded Memory via LITERALs <3.8.3/3.10.0-rc1 Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.	Cyrus Imap