Low WID-SEC-2026-3301 6 CVEs

cyrus imap: Mehrere Schwachstellen

Published Sep 9, 2026 · Updated Sep 24, 2026 · Revision 2 · de-DE

Vendor: SUSE Product: openSUSE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in cyrus imap ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

Cyrus IMAP ist ein Mail server, der IMAP, POP3, NNTP und Sieve Unterstützung bietet.

Vulnerabilities 6

Medium 4.3

CVE-2026-61907

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Sep 9, 2026
Medium 4.3

CVE-2026-61911

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user c…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Sep 9, 2026
Medium 4.2

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar u…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Sep 9, 2026
Low 3.5

CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated …

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Sep 9, 2026
Low 3.5

CVE-2026-61910

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailb…

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Sep 9, 2026
Low 3.1

CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. …

cyrusimap Cyrus IMAP cyrus-imapd cyrus-imapd Debian Ubuntu

Sep 9, 2026

Revision history

2026-09-24 #2
Neue Updates von openSUSE aufgenommen
2026-09-09 #1
Initiale Fassung

References

Cyrus IMAP Release Notes vom 2026-09-09
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
Cyrus IMAP Release Notes vom 2026-09-09
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html
Cyrus IMAP Release Notes vom 2026-09-09
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html
EU Vulnerability Databse vom 2026-09-09
https://euvd.enisa.europa.eu/enisa/EUVD-2026-75129
EU Vulnerability Databse vom 2026-09-09
https://euvd.enisa.europa.eu/enisa/EUVD-2026-75130
EU Vulnerability Databse vom 2026-09-09
https://euvd.enisa.europa.eu/enisa/EUVD-2026-75132
EU Vulnerability Databse vom 2026-09-09
https://euvd.enisa.europa.eu/enisa/EUVD-2026-75134
EU Vulnerability Databse vom 2026-09-09
https://euvd.enisa.europa.eu/enisa/EUVD-2026-75139
EU Vulnerability Databse vom 2026-09-09
https://euvd.enisa.europa.eu/enisa/EUVD-2026-75168
openSUSE Security Update OPENSUSE-SU-2026:21929-1 vom 2026-09-24
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/D4MKH5XKHNCJMVKZH622JLY5XEWCYRFP/