Cyrus IMAP 3.8.8 Release Notes

Download from GitHub:

Changes since 3.8.7

Security fixes

  • CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL

    An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

    Reported by: Michael Lynch (mtlynch.io).

  • CVE-2026-61908: JMAP email-header blob ID out-of-bounds index

    An authenticated user could attempt to download a specially crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.

    Reported by: Ahmed Said.

  • CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL

    An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

    Reported by: Ahmed Said.

  • CVE-2026-61910 Mailbox/set let sharee change special-use role on shared mailboxes

    An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended.

    This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.

    Reported by: Michael Lynch (mtlynch.io).

  • CVE-2026-61911 Sieve mailbox existence oracle

    An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

    Reported by: Michael Lynch (mtlynch.io).

  • CVE-2026-61915: VPATCH BYPARAM double-free

    An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

    Reported by: Michael Lynch (mtlynch.io).

Build changes

  • Fixed: Issue #5189: detect cld2 and wslay without pkg-config

  • Fixed: Issue #6142: build failure in lmtp_sieve on Alpine Linux

Bug fixes

  • Fixed: Issue #6064: escape JMAP logHeaders values before logging

  • Fixed: Issue #6165: JMAP EmailSubmission/set now reports bad rcptTo values as invalidRecipients rather than invalidProperties