openSUSE-SU-2026:21368-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21368-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21368-1
Upstream
CVE (9)
  • CVE-2026-47081
  • CVE-2026-47082
  • CVE-2026-47083
  • CVE-2026-47084
  • CVE-2026-47085
  • CVE-2026-47086
  • CVE-2026-47087
  • CVE-2026-47088
  • CVE-2026-47089
Related
CVE (9)
  • CVE-2026-47081
  • CVE-2026-47082
  • CVE-2026-47083
  • CVE-2026-47084
  • CVE-2026-47085
  • CVE-2026-47086
  • CVE-2026-47087
  • CVE-2026-47088
  • CVE-2026-47089
Published
2026-07-17T15:44:26Z
Modified
2026-07-19T13:15:06Z
Summary
Security update for cyrus-imapd
Details

This update for cyrus-imapd fixes the following issues:

Changes in cyrus-imapd:

  • Update to 3.8.7 (bugfix release)
  • CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack (bsc#1271617)
  • CVE-2026-47083: ESEARCH cross-user content oracle (bsc#1271619)
  • CVE-2026-47082: Vacation "fcc" skips destination-mailbox ACL (bsc#1271618)
  • CVE-2026-47084: LOCALDELETE bypassed ACL checks (bsc#1271620)
  • CVE-2026-47085: URLAUTH token forgery via missing mboxkey (bsc#1271621)
  • CVE-2026-47086: GENURLAUTH issued tokens bypassing ACLs (bsc#1271622)
  • CVE-2026-47087: URLAUTH does not honor revoked authorizer access (bsc#1271623)
  • CVE-2026-47088: Heap exposure in nested MIME comment parsing (bsc#1271624)
  • CVE-2026-47089: LISTRIGHTS not limited to users with admin access (bsc#1271625)
References

Affected packages

openSUSE:Leap 16.0 / cyrus-imapd

Package

Name
cyrus-imapd
Purl
pkg:rpm/opensuse/cyrus-imapd&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.8.7-bp160.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "cyradm":  "3.8.7-bp160.1.1",
            "cyrus-imapd":  "3.8.7-bp160.1.1",
            "cyrus-imapd-devel":  "3.8.7-bp160.1.1",
            "cyrus-imapd-snmp":  "3.8.7-bp160.1.1",
            "cyrus-imapd-snmp-mibs":  "3.8.7-bp160.1.1",
            "cyrus-imapd-utils":  "3.8.7-bp160.1.1",
            "libcyrus0":  "3.8.7-bp160.1.1",
            "perl-Cyrus-Annotator":  "3.8.7-bp160.1.1",
            "perl-Cyrus-IMAP":  "3.8.7-bp160.1.1",
            "perl-Cyrus-SIEVE-managesieve":  "3.8.7-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21368-1.json"