Cyrusimap

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Cyrusimap product.

RSS Feeds for Cyrusimap security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Cyrusimap products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Cyrusimap Sorted by Most Security Vulnerabilities since 2018

Cyrusimap Cyrus Imap16 vulnerabilities

Cyrusimap Cyrus Sasl3 vulnerabilities

By the Year

In 2026 there have been 15 vulnerabilities in Cyrusimap with an average score of 4.0 out of ten. Cyrusimap did not have any published security vulnerabilities last year. That is, 15 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	15	4.04
2025	0	0.00
2024	1	6.50
2023	0	0.00
2022	1	8.80
2021	0	0.00
2020	0	0.00
2019	1	0.00

It may take a day or so for new Cyrusimap vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Cyrusimap Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-61908	Sep 09, 2026	Cyrus IMAP <3.12.4 OOB Heap Read via JMAP Blob ID An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.	Cyrus Imap
CVE-2026-61909	Sep 09, 2026	Cyrus IMAP <3.12.4 CalDAV/CardDAV multiget ACL bypass An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.	Cyrus Imap
CVE-2026-61910	Sep 09, 2026	Cyrus IMAP <3.12.4: Authenticated Sharee Can Alter Special-Use Role An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)	Cyrus Imap
CVE-2026-61911	Sep 09, 2026	Cyrus IMAP <3.12.4: Sieve Mailbox Existence Oracle An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.	Cyrus Imap
CVE-2026-61915	Sep 09, 2026	Cyrus IMAP <3.12.4: VPATCH BYPARAM doublefree, CalDAV crash An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.	Cyrus Imap
CVE-2026-61907	Sep 09, 2026	Cyrus IMAP <3.12.4: JMAP Snooze ACL Bypass Allows Mail Insertion An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.	Cyrus Imap
CVE-2026-47087	Jul 16, 2026	URLAUTH Revoked Authorizer Access Not Honored in cyrus-imapd 3.12.2 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.	Cyrus Imap
CVE-2026-47081	Jul 16, 2026	Cyrus IMAP 3.12.2 XAPPLEPUSHSERVICE Push Hijack Vulnerability An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.	Cyrus Imap
CVE-2026-47089	Jul 16, 2026	Cyrus IMAP 3.12.2 LISTRIGHTS: Unauthorized access control flaw An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)	Cyrus Imap
CVE-2026-47088	Jul 16, 2026	Cyrus IMAP (cyrus-imapd) 3.12.2 Heap Leak via MIME Comment An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.	Cyrus Imap