Cyrus IMAP 3.13.7 Tag Notes

Unavailable for download as this is a development branch only.

Access is via git.

Warning

This should be considered for testing purposes and bleeding-edge features only. We will try to tag these snapshots at coherent development points, but there will generally be large breaking changes occurring between releases in this series.

Major changes since the 3.12 series

  • Added support for the latest versions of IETF drafts:

    • draft-ietf-jmap-calendars

    • draft-ietf-calext-jscalendarbis

    • draft-ietf-calext-jscalendar-icalendar

    • draft-ietf-calext-icalendar-jscalendar-extensions

    Also added a new experimental httpd module "convert" that converts between media types for selected content types. Initially it only converts between iCalendar and JSCalendar, according to the definition of the IETF draft draft-ietf-calext-jscalendar-icalendar. This module is not meant for production use and is not enabled by default.

  • The annotator is now called only on items added to email-type mailboxes.

  • ctl_conversationsdb(8) now has -U for version upgrades.

  • lmtpd(8) now provides a capability called TRACE and a new TRACE command for setting an interal trace-id, which will be logged.

  • The admins_get_internal_seen option has been added. If set, the admin users will always get and set the same \Seen flags as the mailbox owner.

  • master(8) will refuse to start if multiple partitions appear to be identical or overlap. (Issue #5573:)

  • Cyrus syslogs are in the process of being converted to logfmt, a structured logging format. So far, this affects primarily the login logs and auditlog.

  • The backupcyrusd(8) protocol daemon has been added to facilitate rolling backups.

  • The expire_by_savedate and expire_keep_flagged options have been added to control the behavior of cyr_expire(8).

  • Time zone data is no longer included in iTIP messages.

  • The IMAP PREVIEW extension will now only be advertised if the jmap_preview_annot option is set and begins with /shared/.

  • Support for the IMAP UIDBATCHES extension has been added.

  • cyrus.conf(5) can now schedule EVENTS with cron-like syntax.

  • The new sieve_mdn_original_recipient_header option allows an install to get the original recipient from a header other than Original-Recipient.

  • The new sieve_mdn_private option helps prevent leaking usernames.

  • A new database backend called twom has been added.

  • Adds support for the Sieve 'vnd.cyrus.redirect-multiple' extension which allows the 'redirect' action to accept a stringlist of email addresses, in addition to the standard single string. Cyrus will use a single SMTP transaction, providing each address as a RCPT TO and stop script processing when any response is an error.

  • The 'sieve_extensions' option now accepts the value 'vnd.cyrus.redirect-multiple' to enable the extension in timsieved.

  • Cyrus now requires libical >= 4.0.0, or a current development snapshot.

  • Cyrus now requires libxapian >= 2.0.0, or a recent 1.5.x bleeding edge snapshot.

  • JMAP methods now use perfect hashes (gperf) for increased performance.

  • The code in lib/imapoptions has been refactored for easier maintenance and extensibility.

  • Building Cyrus now requires perl >= 5.28.0 and the modules Moo and App::Cmd. These are usually available as OS packages - e.g. on Debian-based systems as libmoo-perl and libapp-cmd-perl

  • The mkimap(8) and rehash(8) tools are now installed to --sbindir by make install.

  • Content for the documentation site (cyrusimap.org) can now be written in Markdown. Building the documentation, therefore, will now require myst_parser, which is what makes this possible.

  • The hash table code has been refactored to reduce memory usage and improve performance.

  • IMIP notifications sent to the notify socket now include the username of the authenticated user who triggered the change.

  • The temporary directory used by unit tests can now be set using the CYRUS_CUNIT_TMPDIR configure variable.

  • calalarmd now logs the scheduled-vs-actual send delay for every send it performs, via a new "auditlog.calalarmd.send.*" audit event

  • The configdirectory must now be an absolute path.

Updates to default configuration

  • OpenSSL version 3.0 or greater is now required for all builds.

  • HTTP support, *DAV (CalDAV, CardDAV, WebDAV) and the calendar alarm daemon are now mandatory parts of every Cyrus IMAP build. The --enable-http and --enable-calalarmd configure options have been removed; the httpd binary and calalarmd are always built. libical, libxml2 and SQLite3 are now required build dependencies.

Removed features

  • The undocumented XSTATS metrics system has been removed.

  • The undocumented XKILLMY command and its associated SIGUSR2 handler have been removed.

  • lipcap support has been removed.

  • The tls_server_dhparam option has been deprecated.

  • The experimental zeroskip database backend has been removed.

  • Support for the obscure "objectstore" feature has been removed.

  • The long deprecated installsieve program has been removed. Please use sieveshell(1) instead.

  • The legacy JMAP Contacts API has been removed (Contact/* and ContactGroup/*) - use ContactCard/* instead.

  • The following options are now deprecated:

  • caringo_hostname

  • caringo_port

  • object_storage_dummy_spool

  • object_storage_enabled

  • openio_account

  • openio_autocreate

  • openio_namespace

  • openio_proxy_timeout

  • openio_rawx_timeout

  • openio_verbosity

Security fixes

  • CVE-2026-47084 LOCALDELETE bypassed ACL checks

    An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.

    Reported by: Michael Lynch (mtlynch.io)

  • CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs

    Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.

    Reported by: Matthew Horsfall

  • CVE-2026-47087 URLAUTH does not honor revoked authorizer access

    A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.

    Reported by: Matthew Horsfall

  • CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack

    An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.

    Reported by Matthew Horsfall.

  • CVE-2026-47089 LISTRIGHTS not limited to users with admin access

    An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

    Reported by: Matthew Horsfall

  • CVE-2026-47085 URLAUTH token forgery via missing mboxkey

    If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing HMAC-SHA1 with a predictable key, allowing them read access to the mailbox.

    URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. We are unaware of any clients using URLAUTH.

    Reported by: Matthew Horsfall

  • CVE-2026-47083 ESEARCH cross-user content oracle

    Using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching search, creating a content oracle without allowing arbitrary reads of the target's content.

    Reported by: Michael Lynch (mtlynch.io)

  • CVE-2026-47088 Heap exposure in nested MIME comment parsing

    An authenticated IMAP user could specially craft an email containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message end in memory and read into the heap, returning the read content to the user.

    Reported by: Michael Lynch (mtlynch.io).

  • CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL

    A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.

    Reported by: Michael Lynch (mtlynch.io)

Significant bugfixes