{"id":"CVE-2026-61909","aliases":["CLSA-2026-1790173408","CLSA-2026-1790974923","DEBIAN-CVE-2026-61909","EUVD-2026-75132","GHSA-q4vc-r364-vq8w","UBUNTU-CVE-2026-61909","openSUSE-SU-2026:21929-1"],"status":"published","title":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href...","description":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00204,"percentile":0.10516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-420"],"published":"2026-09-09T00:00:00Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"Debian:14","package":"cyrus-imapd","fixed_in":["3.12.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-2.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-2.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cyrus-imapd-doc-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-2.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cyrus-imapd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-2.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-2.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cyrus-imapd-virusscan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-2.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"perl-Cyrus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-2.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-doc-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cyrus-imapd-virusscan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Cyrus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-7.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-1","3.10.0~beta1-1","3.10.0~beta1-2","3.10.0~beta1-3","3.10.0~beta2-1","3.10.0~rc2-1","3.10.1-1","3.10.1-2","3.10.1-3","3.10.1-3~bpo12+1","3.10.2-1","3.10.2-1~bpo12+1","3.12.0-1","3.12.0-2","3.12.1-1","3.12.1-2","3.12.1-3","3.12.2-1","3.12.3-1","3.12.3-1~bpo13+1","3.12.3-2","3.12.3-3","3.12.3-4","3.12.4-1","3.6.1-4","3.6.1-4+deb12u1","3.6.1-4+deb12u2","3.6.1-4+deb12u3","3.6.1-4+deb12u4","3.6.1-4+deb12u5","3.8.0-1","3.8.0-2","3.8.0-3","3.8.0-4","3.8.0-5","3.8.0~beta1-1","3.8.0~beta2-1","3.8.0~rc1-1","3.8.1-1","3.8.1-1~bpo12+1","3.8.1-2","3.8.1-3","3.8.2-1","3.8.3-1","3.8.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1","3.10.2-1+deb13u1","3.10.2-1+deb13u2","3.12.0-1","3.12.0-2","3.12.1-1","3.12.1-2","3.12.1-3","3.12.2-1","3.12.3-1","3.12.3-1~bpo13+1","3.12.3-2","3.12.3-3","3.12.3-4","3.12.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1"}]}],"versions":["3.10.2-1","3.12.0-1","3.12.0-2","3.12.1-1","3.12.1-2","3.12.1-3","3.12.2-1","3.12.3-1","3.12.3-1~bpo13+1","3.12.3-2","3.12.3-3","3.12.3-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1","2.5.10-3ubuntu1.1","2.5.10-3ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11-1","3.0.11-1build1","3.0.12-1","3.0.12-2","3.0.12-2ubuntu2","3.0.12-2ubuntu3","3.0.13-2ubuntu1","3.0.13-3ubuntu1","3.0.13-4ubuntu1","3.0.13-5","3.0.13-5ubuntu0.1~esm1","3.0.13-5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.6-2build1","3.4.2-2","3.4.2-2build1","3.4.3-2","3.4.3-3","3.4.3-3build2","3.4.3-3ubuntu0.1","3.4.3-3ubuntu0.1+esm1","3.4.3-3ubuntu0.3","3.4.3-3ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-5","3.8.1-1","3.8.1-1build1","3.8.1-1build2","3.8.1-3","3.8.1-3build3","3.8.2-1","3.8.2-1ubuntu0.1~esm1","3.8.2-1ubuntu0.2","3.8.2-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.1-3","3.12.2-1","3.12.2-1build1","3.12.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1","3.12.1-2","3.12.1-2build1","3.12.1-3"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.8-bp160.1.1"}]}],"bundled":6}],"products":[{"vendor":"cyrus","product":"imap"},{"vendor":"cyrusimap","product":"cyrus imap"}],"references":[{"url":"https://cyrusimap.org","tags":["Product","web"]},{"url":"https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html","tags":["Release Notes","web"]},{"url":"https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html","tags":["Release Notes","web"]},{"url":"https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html","tags":["Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61909","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q4vc-r364-vq8w"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790173408.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61915","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790974923.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61909.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-61909","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-61909","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61909","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279908","tags":["report"]},{"url":"https://bugzilla.suse.com/1279975","tags":["report"]},{"url":"https://bugzilla.suse.com/1279976","tags":["report"]},{"url":"https://bugzilla.suse.com/1279977","tags":["report"]},{"url":"https://bugzilla.suse.com/1279978","tags":["report"]},{"url":"https://bugzilla.suse.com/1279979","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61915","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-61909","description":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-14T15:21:10.144Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-75132","description":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-14T15:21:10Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:28:20.426868Z"}],"ghsa":[{"id":"GHSA-q4vc-r364-vq8w","title":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href...","description":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.","status":"published","published":"2026-09-09T21:31:56Z","modified":"2026-09-09T21:32:03Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T15:11:40.819612Z"}],"nvd":[{"id":"CVE-2026-61909","description":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.","status":"published","published":"2026-09-09T20:18:36.523Z","modified":"2026-09-16T15:24:24.07Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"CVE-2026-61909","description":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-10-28T02:30:29.913741062Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-420"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-61909","description":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.","status":"published","published":"2026-09-09T20:18:36.523Z","modified":"2026-10-01T03:03:28.793187999Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-61909","description":"An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.","status":"published","published":"2026-09-09T14:00:00Z","modified":"2026-10-17T12:59:15.073404644Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"CLSA-2026-1790173408","title":"cyrus-imapd: Fix of 3 CVEs","description":"- fix CVE-2026-61915: double-free in the CalDAV VPATCH BYPARAM selector\n- fix CVE-2026-61909: calendar/addressbook-multiget returned resources the user has no ACL on\n- fix CVE-2026-61911: Sieve mailboxexists/metadata probed other users' mailboxes without a lookup-rights check\n- do not free VPATCH parameters already removed by reference: libical frees them in icalproperty_remove_parameter_by_ref(), so the following icalparameter_free() aborted the CalDAV worker on any VPATCH carrying a PATCH-ACTION parameter, before the CVE-2026-61915 code path could be reached\n- add the upstream cunit regression test for CVE-2026-61915\n- run the cunit suite in %check even when cassandane is disabled, so the regression test above actually executes","status":"published","published":"2026-09-23T14:23:39Z","modified":"2026-10-26T09:43:36.723242991Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790974923","title":"cyrus-imapd: Fix of 2 CVEs","description":"- fix CVE-2026-61911: Sieve mailboxexists/metadata tests ignored the\n  lookup ACL on another user's mailbox\n- fix CVE-2026-61909: CalDAV/CardDAV multiget did not check the ACL of\n  each requested href","status":"published","published":"2026-10-02T21:02:16Z","modified":"2026-10-26T09:43:21.515395687Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"openSUSE-SU-2026:21929-1","title":"Security update for cyrus-imapd","description":"This update for cyrus-imapd fixes the following issues:\n\nChanges in cyrus-imapd:\n\nUpdate to 3.8.8 (bugfix release):\n\n- CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL (bsc#1279908)\n- CVE-2026-61908: JMAP email-header blob ID out-of-bounds index (bsc#1279975)\n- CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL (bsc#1279976)\n- CVE-2026-61910: Mailbox/set let sharee change special-use role on shared mailboxes (bsc#1279977)\n- CVE-2026-61911: Sieve mailbox existence oracle (bsc#1279978)\n- CVE-2026-61915: VPATCH BYPARAM double-free (bsc#1279979)\n","status":"published","published":"2026-09-22T15:42:33Z","modified":"2026-09-25T18:23:14.142636484Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}