OPENSUSE-SU-2026:21368-1: cyrus-imapd&distro=openSUSE Leap 16.0 openSUSE
Vulnerability summary
OPENSUSE-SU-2026:21368-1 is a vulnerability in cyrus-imapd&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.
Advisory lineage
Upstream 9 · Downstream 0 · Related 9Timeline
- 17-07-2026PublishedVulnerability first disclosed.
- 19-07-2026Last modifiedVulnerability information updated.
Description
Security update for cyrus-imapd This update for cyrus-imapd fixes the following issues: Changes in cyrus-imapd: - Update to 3.8.7 (bugfix release) - CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack (bsc#1271617) - CVE-2026-47083: ESEARCH cross-user content oracle (bsc#1271619) - CVE-2026-47082: Vacation "fcc" skips destination-mailbox ACL (bsc#1271618) - CVE-2026-47084: LOCALDELETE bypassed ACL checks (bsc#1271620) - CVE-2026-47085: URLAUTH token forgery via missing mboxkey (bsc#1271621) - CVE-2026-47086: GENURLAUTH issued tokens bypassing ACLs (bsc#1271622) - CVE-2026-47087: URLAUTH does not honor revoked authorizer access (bsc#1271623) - CVE-2026-47088: Heap exposure in nested MIME comment parsing (bsc#1271624) - CVE-2026-47089: LISTRIGHTS not limited to users with admin access (bsc#1271625)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Opensuse1 product
- cyrus-imapd&distro=openSUSE Leap 16.0< 3.8.7-bp160.1.1
1 vendor · 1 product