DeutschShown in its original language — a full translation is planned for a future version.
cyrus imap: Mehrere Schwachstellen
view advisory published 2026-09-09
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in cyrus imap ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.
01
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-61915US | high7.1 | — | ||
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing… | ||||
| CVE-2026-61911US | — | — | ||
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user'… | ||||
| CVE-2026-61910US | medium5.0OT elevated | — | ||
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another us… | ||||
| CVE-2026-61909US | medium4.3 | — | ||
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar o… | ||||
| CVE-2026-61908US | medium6.5 | — | ||
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMA… | ||||
| CVE-2026-61907US | —OT elevated | — | ||
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailb… | ||||
02
references
External citations — patches, advisories, analysis.
- EU Vulnerability Databse vom 2026-09-09external
- EU Vulnerability Databse vom 2026-09-09external
- EU Vulnerability Databse vom 2026-09-09external
- EU Vulnerability Databse vom 2026-09-09external
- EU Vulnerability Databse vom 2026-09-09external
- EU Vulnerability Databse vom 2026-09-09external
- openSUSE Security Update OPENSUSE-SU-2026:21929-1 vom 2026-09-24external
- WID-SEC-W-2026-3301 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan