--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:cyrus-imapd
User: [email protected]
Usertags: pu
[ Reason ]
9 open CVE issues in trixie that are fixed in testing.
[ Impact ]
Users are vulnerable to the security issues.
[ Tests ]
I (sponsor) have only build-tested this on amd64.
The submitter may have done additional tests and I have
asked him to submit additional details.
[ Risks ]
(Discussion of the risks involved. E.g. code is trivial or
complex, alternatives available.)
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in stable
[x] the issue is verified as fixed in unstable
[ Changes ]
This includes the upstream patches from the stable 3.10 tree that
are marked to fix the CVEs and apply cleanly on the trixie version.
diff -Nru cyrus-imapd-3.10.2/debian/changelog
cyrus-imapd-3.10.2/debian/changelog
--- cyrus-imapd-3.10.2/debian/changelog 2026-07-12 21:29:05.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/changelog 2026-07-27 23:12:24.000000000 +0200
@@ -1,3 +1,11 @@
+cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium
+
+ * Add CVE fixes from upstream branch/version 3.10.3: CVE-2026-47084,
+ CVE-2026-47086, CVE-2026-47087, CVE-2026-47081, CVE-2026-47089,
+ CVE-2026-47085, CVE-2026-47083, CVE-2026-47088, CVE-2026-47082.
+
+ -- Codin <[email protected]> Mon, 27 Jul 2026 14:12:24 -0700
+
cyrus-imapd (3.10.2-1+deb13u1) trixie; urgency=medium
* http_jmap: allow JMAP EventSource without WebSocket/wslay; backport
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch
cyrus-imapd-3.10.2/debian/patches/0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch
---
cyrus-imapd-3.10.2/debian/patches/0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,100 @@
+From db6d646d001c396dd1406db74eb4b98c081e15ed Mon Sep 17 00:00:00 2001
+From: Ricardo Signes <[email protected]>
+Date: Thu, 23 Apr 2026 08:31:14 +1000
+Subject: [PATCH] lmtp_sieve.c: enforce ACL on vacation :fcc destination
+
+Enforce *some* ACL check when delivering the fcc for a vacation message!
+Rather than pass aclcheck=0, pass ACL_INSERT: the script owner must be
+able to write to the target mailbox.
+
+This is CYR-2892, CVE-2026-47082.
+
+This problem was reported by Michael Lynch (mtlynch.io).
+
+Co-authored-by: Claude <[email protected]>
+---
+ .../Sieve/vacation_with_fcc_otheruser_denied | 58 +++++++++++++++++++
+ imap/lmtp_sieve.c | 2 +-
+ 2 files changed, 59 insertions(+), 1 deletion(-)
+ create mode 100644
cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied
+
+diff --git a/cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied
b/cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied
+new file mode 100644
+index 000000000..ed9ff9a92
+--- /dev/null
++++ b/cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied
+@@ -0,0 +1,58 @@
++#!perl
++use Cassandane::Tiny;
++
++sub test_vacation_with_fcc_otheruser_denied
++ :min_version_3_1
++ :NoAltNameSpace
++ :want_smtpdaemon
++{
++ my ($self) = @_;
++
++ my $target = "user.other.target";
++
++ xlog $self, "Create victim user 'other' and a target folder";
++ $self->{instance}->create_user('other');
++
++ my $admintalk = $self->{adminstore}->get_client();
++ $admintalk->create($target)
++ or die "Cannot create $target: $@";
++
++ xlog $self, "Give cassandane read-only access (no 'i'/'p' rights)";
++ $admintalk->setacl($target, 'cassandane' => 'lrs');
++ $self->assert_str_equals('ok',
++ $admintalk->get_last_completion_response());
++
++ xlog $self, "Confirm cassandane cannot APPEND directly to $target";
++ my $talk = $self->{store}->get_client();
++ $talk->append($target,
++ "From: nobody\@example.com\r\n"
++ . "Subject: direct-append\r\n\r\n"
++ . "denied\r\n");
++ $self->assert_str_equals('no',
++ $talk->get_last_completion_response());
++
++ xlog $self, "Install a vacation rule that :fcc's into the victim's
folder";
++ $self->{instance}->install_sieve_script(<<EOF
++require ["vacation", "fcc"];
++
++vacation :fcc "$target" :days 1 :addresses ["cassandane\@example.com"] text:
++I am out of the office today. I will answer your email as soon as I can.
++.
++;
++EOF
++ );
++
++ xlog $self, "Deliver a message to trigger the vacation auto-reply";
++ my $msg1 = $self->{gen}->generate(
++ subject => "Message 1",
++ to => Cassandane::Address->new(localpart => 'cassandane',
++ domain => 'example.com'),
++ );
++ $self->{instance}->deliver($msg1);
++
++ xlog $self, "Check that nothing was filed into the victim's folder";
++ $admintalk->select($target);
++ $self->assert_str_equals('ok',
++ $admintalk->get_last_completion_response());
++ $self->assert_num_equals(0, $admintalk->get_response_code('exists'));
++}
+diff --git a/imap/lmtp_sieve.c b/imap/lmtp_sieve.c
+index f13a26629..b85bf1ad2 100644
+--- a/imap/lmtp_sieve.c
++++ b/imap/lmtp_sieve.c
+@@ -1931,7 +1931,7 @@ static void do_fcc(script_data_t *sdata,
sieve_fileinto_context_t *fcc,
+ }
+ if (!r) {
+ r = append_setup(&as, intname, userid, sdata->authstate,
+- 0, NULL, NULL, 0, EVENT_MESSAGE_APPEND);
++ ACL_INSERT, NULL, NULL, 0, EVENT_MESSAGE_APPEND);
+ }
+ if (!r) {
+ struct stagemsg *stage;
+--
+2.47.3
+
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch
cyrus-imapd-3.10.2/debian/patches/0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch
---
cyrus-imapd-3.10.2/debian/patches/0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,147 @@
+From 23495997b52a1ffdbc8b655d803f0b58167e40d6 Mon Sep 17 00:00:00 2001
+From: Ricardo Signes <[email protected]>
+Date: Wed, 22 Apr 2026 15:55:30 +1000
+Subject: [PATCH] imap/message.c: fix heap exposure in nested MIME comment
+ parsing
+
+Fix out-of-bounds read in message_parse_rfc822space() when parsing RFC
+822 comments that end with backslash. The backslash case would increment
+p past a NUL terminator, and the subsequent loop increment would read
+into adjacent heap memory.
+
+Add bounds check after backslash handling to prevent reading past the
+end of the buffer.
+
+This is CYR-2882, CVE-2026-47088.
+
+This problem was reported by Michael Lynch (mtlynch.io).
+
+Co-Authored-By: Claude <[email protected]>
+---
+ cassandane/Cassandane/Cyrus/MIME.pm | 40 +++++++++++++++
+ cassandane/tiny-tests/MIME/nested_comment_oob | 50 +++++++++++++++++++
+ imap/message.c | 4 ++
+ 3 files changed, 94 insertions(+)
+ create mode 100644 cassandane/Cassandane/Cyrus/MIME.pm
+ create mode 100644 cassandane/tiny-tests/MIME/nested_comment_oob
+
+diff --git a/cassandane/Cassandane/Cyrus/MIME.pm
b/cassandane/Cassandane/Cyrus/MIME.pm
+new file mode 100644
+index 000000000..58df5a251
+--- /dev/null
++++ b/cassandane/Cassandane/Cyrus/MIME.pm
+@@ -0,0 +1,40 @@
++# SPDX-License-Identifier: BSD-3-Clause-CMU
++# See COPYING file at the root of the distribution for more details.
++
++package Cassandane::Cyrus::MIME;
++use strict;
++use warnings;
++use Data::Dumper;
++
++use base qw(Cassandane::Cyrus::TestCase);
++use Cassandane::Util::Log;
++
++sub new
++{
++ my ($class, @args) = @_;
++
++ my $config = Cassandane::Config->default()->clone();
++
++ my $self = $class->SUPER::new({
++ config => $config,
++ services => [ 'imap' ]
++ }, @args);
++
++ return $self;
++}
++
++sub set_up
++{
++ my ($self) = @_;
++ $self->SUPER::set_up();
++}
++
++sub tear_down
++{
++ my ($self) = @_;
++ $self->SUPER::tear_down();
++}
++
++use Cassandane::Tiny::Loader 'tiny-tests/MIME';
++
++1;
+diff --git a/cassandane/tiny-tests/MIME/nested_comment_oob
b/cassandane/tiny-tests/MIME/nested_comment_oob
+new file mode 100644
+index 000000000..b47f6b1b3
+--- /dev/null
++++ b/cassandane/tiny-tests/MIME/nested_comment_oob
+@@ -0,0 +1,50 @@
++#!perl
++use Cassandane::Tiny;
++
++sub test_nested_comment_oob
++{
++ my ($self) = @_;
++
++ my $talk = $self->{store}->get_client();
++
++ # Create a multipart message where the vulnerability is in a nested part.
++ # Based on the PoC description, this reproduces the backslash handling bug
++ # in message_parse_rfc822space() when parsing nested Content-Type headers.
++ # The malformed header must be the last content to ensure backslash is
final byte.
++ my $msg = <<'EOF';
++From: [email protected]
++To: [email protected]
++Subject: Test heap disclosure
++Content-Type: multipart/mixed; boundary="BOUNDARY"
++
++--BOUNDARY
++Content-Type: text/plain
++
++This is a normal part.
++
++--BOUNDARY
++Content-Type: text/plain (\
++EOF
++
++ # Remove trailing newline so backslash is the final byte before NUL
++ chomp $msg;
++ $msg =~ s/\r?\n/\r\n/gs;
++
++ # Append the message
++ $talk->append('INBOX', $msg) || die $@;
++
++ # Select the mailbox
++ $talk->select('INBOX');
++ $self->assert_str_equals('ok', $talk->get_last_completion_response());
++
++ # Fetch BODYSTRUCTURE - this exercises the vulnerable MIME parsing code
++ # In vulnerable versions, this may crash or leak heap data as MIME
parameters
++ my $response = $talk->fetch('1', 'BODYSTRUCTURE');
++ $self->assert_str_equals('ok', $talk->get_last_completion_response());
++
++ # Log the bodystructure for manual inspection of any anomalies
++ # In a release build with heap spray, unexpected parameters may appear
++ if ($response && $response->{1} && $response->{1}->{bodystructure}) {
++ xlog $self, "BODYSTRUCTURE: " .
Data::Dumper::Dumper($response->{1}->{bodystructure});
++ }
++}
+diff --git a/imap/message.c b/imap/message.c
+index a5b633e19..f18b1c6f6 100644
+--- a/imap/message.c
++++ b/imap/message.c
+@@ -1768,6 +1768,10 @@ static void message_parse_rfc822space(const char **s)
+
+ case '\\':
+ p++;
++ if (*p == '\0') {
++ *s = 0; /* backslash at end of string */
++ return;
++ }
+ break;
+
+ case '(':
+--
+2.47.3
+
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch
cyrus-imapd-3.10.2/debian/patches/0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch
---
cyrus-imapd-3.10.2/debian/patches/0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,94 @@
+From 0534c4e30a4a09e9b8d606bf8f0e874152e8f294 Mon Sep 17 00:00:00 2001
+From: Ricardo Signes <[email protected]>
+Date: Wed, 22 Apr 2026 08:51:29 +1000
+Subject: [PATCH] imapd: MULTISEARCH must check ACL_READ on each mailbox
+
+multisearch_cb opened caller-supplied mailboxes from
+MAILBOXES/SUBTREE/SUBTREE-ONE and ran index_search on them without
+checking whether the caller could read the mailbox. SELECT has the
+equivalent gate (imapd.c:5001); MULTISEARCH did not.
+
+The effect is a cross-user read oracle: SUBTREE on another user's
+account returns one `* ESEARCH ... MAILBOX "..."` line per folder
+(folder enumeration for free), and BODY/SUBJECT predicates then probe
+the contents one search at a time. An attacker only needs to be able
+to name a target mailbox.
+
+This is CYR-2881, CVE-2026-47083.
+
+This problem was reported by Michael Lynch (mtlynch.io).
+
+Co-Authored-By: Claude <[email protected]>
+---
+ cassandane/Cassandane/Cyrus/Search.pm | 40 +++++++++++++++++++++++++++
+ imap/imapd.c | 5 ++++
+ 2 files changed, 45 insertions(+)
+
+diff --git a/cassandane/Cassandane/Cyrus/Search.pm
b/cassandane/Cassandane/Cyrus/Search.pm
+index 19e16fab7..d9e5e9e1e 100644
+--- a/cassandane/Cassandane/Cyrus/Search.pm
++++ b/cassandane/Cassandane/Cyrus/Search.pm
+@@ -757,4 +757,44 @@ sub test_uidsearch_empty
+ $self->assert_str_equals('0', $results[0][3]);
+ }
+
++sub test_multisearch_cross_user
++ :NoAltNamespace
++{
++ my ($self) = @_;
++
++ my $admintalk = $self->{adminstore}->get_client;
++ my $talk = $self->{store}->get_client;
++
++ # victim has a private subfolder with a message. cassandane has no
++ # explicit grant on it, only whatever the "anyone p" default provides --
++ # i.e. ACL_POST, which is not enough to run a search.
++ $self->{instance}->create_user('victim');
++
++ $admintalk->create('user.victim.private')
++ || die "create: " . $admintalk->get_last_error;
++
++ $admintalk->append(
++ 'user.victim.private',
++ "From: t\@example.com\r\nSubject: secret\r\n\r\nconfidential body",
++ ) || die "append: " . $admintalk->get_last_error;
++
++ # Check our assumptions: default user has no access to victim's private
++ # folder.
++ $talk->select('user.victim.private');
++ $self->assert_str_equals('no', $talk->get_last_completion_response);
++
++ # The actual test: assert that cassandane user can't find anything by
++ # ESEARCHing victim's private mailbox.
++ my @esearch_responses;
++ $talk->_imap_cmd(
++ 'ESEARCH', 0,
++ { esearch => sub { push @esearch_responses, $_[1] } },
++ 'IN', '(MAILBOXES "user.victim.private")',
++ 'RETURN', '(ALL)', 'ALL',
++ );
++
++ $self->assert_str_equals('ok', $talk->get_last_completion_response);
++ $self->assert_deep_equals([], \@esearch_responses);
++}
++
+ 1;
+diff --git a/imap/imapd.c b/imap/imapd.c
+index f48b63911..89963ebe9 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -6080,6 +6080,11 @@ static int multisearch_cb(const mbentry_t *mbentry,
void *rock)
+ hash_lookup(mbentry->name, &mrock->mailboxes))
+ return 0;
+
++ /* Skip mailboxes the caller can't read. */
++ if (!imapd_userisadmin &&
++ !(cyrus_acl_myrights(imapd_authstate, mbentry->acl) & ACL_READ))
++ return 0;
++
+ switch (mrock->filter) {
+ case SEARCH_SOURCE_INBOXES:
+ /* Only allow user's INBOX or those postable by anonymous */
+--
+2.47.3
+
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch
cyrus-imapd-3.10.2/debian/patches/0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch
---
cyrus-imapd-3.10.2/debian/patches/0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,44 @@
+From 1d39d32c3b6a61241651763855b336122686fd7e Mon Sep 17 00:00:00 2001
+From: Ricardo Signes <[email protected]>
+Date: Tue, 21 Apr 2026 08:16:10 +1000
+Subject: [PATCH] imapd: reject URLFETCH when no mboxkey exists for the mailbox
+
+Instead of treating "there's no mboxkey.db entry for this folder" as
+indicating a zero-length key, treat a missing mboxkey entry as a
+validation failure.
+
+(Also close the mboxkey db on the previously-unclosed error paths.)
+
+This is CYR-2876, CVE-2026-47085.
+
+This problem reported by Matthew Horsfall.
+
+Co-Authored-By: Claude <[email protected]>
+---
+ imap/imapd.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/imap/imapd.c b/imap/imapd.c
+index 460c6aac6..f48b63911 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -14076,7 +14076,15 @@ static void cmd_urlfetch(char *tag)
+ if (r) break;
+
+ r = mboxkey_read(mboxkey_db, intname, &key, &keylen);
+- if (r) break;
++ if (!r && (!key || !keylen)) {
++ /* If there's no key, we can't possibly validate against
++ * it! */
++ r = IMAP_BADURL;
++ }
++ if (r) {
++ mboxkey_close(mboxkey_db);
++ break;
++ }
+
+ HMAC(EVP_sha1(), key, keylen, (unsigned char *) arg.s,
+ url.urlauth.rump_len, vtoken, &vtoken_len);
+--
+2.47.3
+
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0024-imapd-LISTRIGHTS-requires-admin-rights.patch
cyrus-imapd-3.10.2/debian/patches/0024-imapd-LISTRIGHTS-requires-admin-rights.patch
---
cyrus-imapd-3.10.2/debian/patches/0024-imapd-LISTRIGHTS-requires-admin-rights.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0024-imapd-LISTRIGHTS-requires-admin-rights.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,43 @@
+From 5c97794e5270b472130af4531f290812cbcc6879 Mon Sep 17 00:00:00 2001
+From: Ricardo Signes <[email protected]>
+Date: Tue, 21 Apr 2026 08:28:15 +1000
+Subject: [PATCH] imapd: LISTRIGHTS requires admin rights
+
+cmd_listrights was refusing only when the caller had *no* rights at
+all on the target mailbox, when it should've been requiring admin
+rights.
+
+With this patch, we'll properly require ACL_ADMIN (owners and admins
+still pass through), matching the check cmd_getacl already uses. When
+the caller has ACL_LOOKUP but not ACL_ADMIN, return PERMISSION_DENIED;
+otherwise hide the mailbox as NONEXISTENT.
+
+This is CYR-2872, CVE-2026-47089.
+
+This problem reported by Matthew Horsfall.
+
+Co-Authored-By: Claude <[email protected]>
+---
+ imap/imapd.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/imap/imapd.c b/imap/imapd.c
+index eacd6cedd..460c6aac6 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -8530,9 +8530,10 @@ static void cmd_listrights(char *tag, char *name, char
*identifier)
+ if (!r) {
+ rights = cyrus_acl_myrights(imapd_authstate, mbentry->acl);
+
+- if (!rights && !imapd_userisadmin &&
++ if (!(rights & ACL_ADMIN) && !imapd_userisadmin &&
+ !mboxname_userownsmailbox(imapd_userid, intname)) {
+- r = IMAP_MAILBOX_NONEXISTENT;
++ r = (rights & ACL_LOOKUP) ?
++ IMAP_PERMISSION_DENIED : IMAP_MAILBOX_NONEXISTENT;
+ }
+ }
+
+--
+2.47.3
+
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch
cyrus-imapd-3.10.2/debian/patches/0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch
---
cyrus-imapd-3.10.2/debian/patches/0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,37 @@
+From 50f77bad3048e7050ad0cd448615d9643463c16d Mon Sep 17 00:00:00 2001
+From: Ricardo Signes <[email protected]>
+Date: Tue, 21 Apr 2026 09:05:40 +1000
+Subject: [PATCH] imapd: require read access for XAPPLEPUSHSERVICE mailboxes
+
+Only accept a mailbox if the caller is its owner, an admin, or holds
+ACL_READ. Anything else is silently skipped (no echo, no event), which
+also preserves the existing "missing" behaviour for non-existent names.
+
+This is CYR-2871, CVE-2026-47081.
+
+This problem reported by Matthew Horsfall.
+
+Co-Authored-By: Claude <[email protected]>
+---
+ imap/imapd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/imap/imapd.c b/imap/imapd.c
+index fba38ed2c..eacd6cedd 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -14820,7 +14820,10 @@ static void cmd_xapplepushservice(const char *tag,
+ char *intname =
+ mboxname_from_external(name, &imapd_namespace, imapd_userid);
+ r = mlookup(tag, name, intname, &mbentry);
+- if (!r && mbtype_isa(mbentry->mbtype) == MBTYPE_EMAIL) {
++ if (!r && mbtype_isa(mbentry->mbtype) == MBTYPE_EMAIL &&
++ (imapd_userisadmin ||
++ mboxname_userownsmailbox(imapd_userid, intname) ||
++ (cyrus_acl_myrights(imapd_authstate, mbentry->acl) & ACL_READ)))
{
+ strarray_push(¬if_mailboxes, name);
+ if (applepushserviceargs->aps_version >= 2) {
+ prot_puts(imapd_out, "* XAPPLEPUSHSERVICE \"mailbox\" ");
+--
+2.47.3
+
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch
cyrus-imapd-3.10.2/debian/patches/0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch
---
cyrus-imapd-3.10.2/debian/patches/0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,52 @@
+From 8380d0fb3d74b5c3a0a198db24ba4d8835781587 Mon Sep 17 00:00:00 2001
+From: Ricardo Signes <[email protected]>
+Date: Wed, 29 Apr 2026 08:38:25 +1000
+Subject: [PATCH] imapd.c: re-check URLAUTH authorizer access just in time
+
+cmd_urlfetch validated the HMAC token against the authorizer's mboxkey,
+but skipped any ACL check whenever url.urlauth.access was set. Sure,
+the rights existed right at that moment, but if access is revoked after
+the URL is created, the URL needs to stop working. We need to just
+check access JIT.
+
+This is CYR-2868, CVE-2026-47087.
+
+Co-Authored-By: Claude <[email protected]>
+---
+ imap/imapd.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/imap/imapd.c b/imap/imapd.c
+index 3392dc622..fba38ed2c 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -14113,6 +14113,26 @@ static void cmd_urlfetch(char *tag)
+ }
+ if (r) goto err;
+
++ /* For URLAUTH-protected URLs, re-check the authorizer's ACL. The
++ * HMAC asserts that authorization DID exist, but may have since been
++ * revoked. We can't read the ACL via state->mailbox here: when the
++ * URL targets the currently-selected mailbox we reuse imapd_index,
++ * whose mailbox handle is closed between commands. */
++ if (url.urlauth.access) {
++ mbentry_t *authz_mbentry = NULL;
++ r = mlookup(NULL, NULL, intname, &authz_mbentry);
++ if (!r) {
++ struct auth_state *authzstate = auth_newstate(url.user);
++ int authz_rights =
++ cyrus_acl_myrights(authzstate, authz_mbentry->acl);
++ auth_freestate(authzstate);
++ if (!(authz_rights & ACL_READ))
++ r = IMAP_BADURL;
++ }
++ mboxlist_entry_free(&authz_mbentry);
++ if (r) goto err;
++ }
++
+ if (url.uidvalidity &&
+ (state->mailbox->i.uidvalidity != url.uidvalidity)) {
+ r = IMAP_BADURL;
+--
+2.47.3
+
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch
cyrus-imapd-3.10.2/debian/patches/0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch
---
cyrus-imapd-3.10.2/debian/patches/0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,45 @@
+From e7a28ccf9bddd64db45542ea4a109d8060eb6f6d Mon Sep 17 00:00:00 2001
+From: Ricardo Signes <[email protected]>
+Date: Tue, 21 Apr 2026 07:57:26 +1000
+Subject: [PATCH] imapd: require read access on mailbox in GENURLAUTH
+
+You can't grant access to things you can't access! Without this check,
+any authenticated user could mint a URLAUTH token for any mailbox they
+could name, because cmd_urlfetch skipped the ACL check whenever
+urlauth.access is set -- it trusts that the presence of a valid HMAC
+means the authorizing user was entitled to delegate.
+
+Require the authorizer to have at least ACL_READ on the mailbox before
+issuing a token.
+
+This is CYR-2868, CVE-2026-47086.
+
+This problem reported by Matthew Horsfall.
+
+Co-Authored-By: Claude <[email protected]>
+---
+ imap/imapd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/imap/imapd.c b/imap/imapd.c
+index dfe782f8f..3392dc622 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -14250,6 +14250,14 @@ static void cmd_genurlauth(char *tag)
+ continue;
+ }
+
++ /* You can't give permission you don't have! */
++ if (!imapd_userisadmin &&
++ !(cyrus_acl_myrights(imapd_authstate, mbentry->acl) & ACL_READ)) {
++ mboxlist_entry_free(&mbentry);
++ r = IMAP_BADURL;
++ goto err;
++ }
++
+ mboxlist_entry_free(&mbentry);
+
+ /* lookup key */
+--
+2.47.3
+
diff -Nru
cyrus-imapd-3.10.2/debian/patches/0028-imapd-fix-cmd_delete-force-handling.patch
cyrus-imapd-3.10.2/debian/patches/0028-imapd-fix-cmd_delete-force-handling.patch
---
cyrus-imapd-3.10.2/debian/patches/0028-imapd-fix-cmd_delete-force-handling.patch
1970-01-01 01:00:00.000000000 +0100
+++
cyrus-imapd-3.10.2/debian/patches/0028-imapd-fix-cmd_delete-force-handling.patch
2026-07-27 23:12:24.000000000 +0200
@@ -0,0 +1,54 @@
+From 304255f5be82cbe9c0b7db7f4dba6b16381da2ec Mon Sep 17 00:00:00 2001
+From: ellie timoney <[email protected]>
+Date: Fri, 17 Apr 2026 11:55:05 +1000
+Subject: [PATCH] imapd: fix cmd_delete 'force' handling
+
+mboxlist_deletemailbox expects to be told whether this is a forced
+action by the MBOXLIST_DELETE_FORCE flag, but this was not being
+plumbed through. Forced actions are supposed to require isadmin
+permission, but with the flag not set correctly, that check was
+being skipped.
+
+As a side effect, a non-admin user could invoke the admin-only
+"localdelete" command and delete mailboxes they shouldn't have
+rights to.
+
+This is CYR-2867, CVE-2026-47084.
+
+This problem was reported by Michael Lynch (mtlynch.io).
+---
+ imap/imapd.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/imap/imapd.c b/imap/imapd.c
+index 65ce5c053..dfe782f8f 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -7350,19 +7350,22 @@ static void cmd_delete(char *tag, char *name, int
localonly, int force)
+ /* local mailbox */
+ if (!r) {
+ int isadmin = imapd_userisadmin || imapd_userisproxyadmin;
++ int delflags = force ? MBOXLIST_DELETE_FORCE : 0;
+
+ if (mbname_isdeleted(mbname)) {
+ r = mboxlist_deletemailbox(mbname_intname(mbname),
+ isadmin, imapd_userid,
+ imapd_authstate, mboxevent,
+- MBOXLIST_DELETE_LOCALONLY);
++ delflags | MBOXLIST_DELETE_LOCALONLY);
+ }
+ else if (!isadmin && mbname_issystem(mbname)) {
+ r = IMAP_PERMISSION_DENIED;
+ }
+ else {
+ delete_user = mboxname_isusermailbox(mbname_intname(mbname), 1);
+- int delflags = (1-force) ? MBOXLIST_DELETE_CHECKACL : 0;
++
++ if (!force)
++ delflags |= MBOXLIST_DELETE_CHECKACL;
+
+ if (!delete_user && mboxlist_haschildren(mbname_intname(mbname)))
{
+ r = IMAP_MAILBOX_HASCHILDREN;
+--
+2.47.3
+
diff -Nru cyrus-imapd-3.10.2/debian/patches/series
cyrus-imapd-3.10.2/debian/patches/series
--- cyrus-imapd-3.10.2/debian/patches/series 2026-07-12 21:29:05.000000000
+0200
+++ cyrus-imapd-3.10.2/debian/patches/series 2026-07-27 23:12:24.000000000
+0200
@@ -7,4 +7,13 @@
0012-Use-UnicodeData.txt-from-system.patch
0018-increase-test-timeout.patch
#0019-propagate-XXFLAGS.patch
+0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch
+0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch
+0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch
+0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch
+0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch
+0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch
+0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch
+0028-imapd-fix-cmd_delete-force-handling.patch
+0024-imapd-LISTRIGHTS-requires-admin-rights.patch
eventsource-without-websocket.patch
--- End Message ---
