Medium WID-SEC-2026-2387 9 CVEs

cyrus imap: Mehrere Schwachstellen

Published Jul 16, 2026 · Updated Sep 1, 2026 · Revision 3 · de-DE

Vendor: Debian Vendor: SUSE Product: Linux Product: openSUSE

Summary

Ein Angreifer kann mehrere Schwachstellen in cyrus imap ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten offenzulegen oder zu manipulieren.

Product

Cyrus IMAP ist ein Mail server, der IMAP, POP3, NNTP und Sieve Unterstützung bietet.

Vulnerabilities 9

Medium 6.5

CVE-2026-47084

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An au…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026
Medium 5.4

CVE-2026-47082

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-m…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026
Medium 4.3

CVE-2026-47083

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By …

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026
Medium 4.3

CVE-2026-47089

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin acce…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026
Medium 4.0

CVE-2026-47085

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mbox…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026
Low 3.5

CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any auth…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026
Low 3.5

CVE-2026-47087

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. …

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026
Low 3.1

CVE-2026-47081

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence ora…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026
Low 3.1

CVE-2026-47088

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment pars…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Jul 16, 2026

Revision history

2026-09-01 #3
Neue Updates von Debian aufgenommen
2026-07-19 #2
Neue Updates von openSUSE aufgenommen
2026-07-16 #1
Initiale Fassung

References

Cyrus IMAP 3.12.3 Release Notes vom 2026-07-16
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html
openSUSE Security Update OPENSUSE-SU-2026:21368-1 vom 2026-07-18
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P27NVZGDOSRT2DSIH4CNXJIETGGJVOMA/
Debian Security Advisory DLA-4766 vom 2026-09-01
https://lists.debian.org/debian-lts-announce/2026/09/msg00001.html