Cyrusimap Cyrus Imap
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Cyrusimap Cyrus Imap.
By the Year
In 2026 there have been 15 vulnerabilities in Cyrusimap Cyrus Imap with an average score of 4.0 out of ten. Cyrus Imap did not have any published security vulnerabilities last year. That is, 15 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 15 | 4.04 |
| 2025 | 0 | 0.00 |
| 2024 | 1 | 6.50 |
It may take a day or so for new Cyrus Imap vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Cyrusimap Cyrus Imap Security Vulnerabilities
Cyrus IMAP <3.12.4: JMAP Snooze ACL Bypass Allows Mail Insertion
CVE-2026-61907
4.3 - Medium
- September 09, 2026
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
AuthZ
Cyrus IMAP <3.12.4: VPATCH BYPARAM doublefree, CalDAV crash
CVE-2026-61915
4.2 - Medium
- September 09, 2026
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
Double-free
Cyrus IMAP <3.12.4: Sieve Mailbox Existence Oracle
CVE-2026-61911
4.3 - Medium
- September 09, 2026
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Cyrus IMAP <3.12.4: Authenticated Sharee Can Alter Special-Use Role
CVE-2026-61910
3.5 - Low
- September 09, 2026
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)
AuthZ
Cyrus IMAP <3.12.4 CalDAV/CardDAV multiget ACL bypass
CVE-2026-61909
3.5 - Low
- September 09, 2026
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.
Unprotected Alternate Channel
Cyrus IMAP <3.12.4 OOB Heap Read via JMAP Blob ID
CVE-2026-61908
3.1 - Low
- September 09, 2026
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
Out-of-bounds Read
Cyrus IMAP 3.12.2: Vacation Fcc ACL Bypass in Sieve Script
CVE-2026-47082
5.4 - Medium
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
AuthZ
ESEARCH cross-user content oracle in cyrus-imapd through 3.12.2
CVE-2026-47083
4.3 - Medium
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
Observable Response Discrepancy
Cyrus IMAP 3.12.2 LOCALDELETE ACL Bypass
CVE-2026-47084
6.5 - Medium
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
AuthZ
Cyrus IMAP 3.12.2 URLAUTH Token Forgery via mboxkey
CVE-2026-47085
4 - Medium
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
Generation of Predictable Numbers or Identifiers
Cyrus IMAP URLAUTH Token Bypass ACL in v3.12.2
CVE-2026-47086
3.5 - Low
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
AuthZ
URLAUTH Revoked Authorizer Access Not Honored in cyrus-imapd 3.12.2
CVE-2026-47087
3.5 - Low
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
Operation on a Resource after Expiration or Release
Cyrus IMAP (cyrus-imapd) 3.12.2 Heap Leak via MIME Comment
CVE-2026-47088
3.1 - Low
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
Buffer Over-read
Cyrus IMAP 3.12.2 LISTRIGHTS: Unauthorized access control flaw
CVE-2026-47089
4.3 - Medium
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)
AuthZ
Cyrus IMAP 3.12.2 XAPPLEPUSHSERVICE Push Hijack Vulnerability
CVE-2026-47081
3.1 - Low
- July 16, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
AuthZ
Cyrus IMAP Auth Attack Causing Unbounded Memory via LITERALs <3.8.3/3.10.0-rc1
CVE-2024-34055
6.5 - Medium
- June 05, 2024
Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.
Allocation of Resources Without Limits or Throttling
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Cyrusimap Cyrus Imap or by Cyrusimap? Click the Watch button to subscribe.
