Cyrus IMAP 3.12.4 Release Notes
*******************************

Download from GitHub:

   * https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-
     imapd-3.12.4/cyrus-imapd-3.12.4.tar.gz

   * https://github.com/cyrusimap/cyrus-imapd/releases/download/cyrus-
     imapd-3.12.4/cyrus-imapd-3.12.4.tar.gz.sig


Changes since 3.12.3
====================


Security fixes
--------------

* CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL

  An authenticated user with insert permissions on another user's
  snoozed mailbox could cause insertion of mail to that user's inbox,
  or any other of their mailboxes whose id was known to the user,
  despite having no insert permissions to the target mailbox.

  Reported by: Michael Lynch (mtlynch.io).

* CVE-2026-61908: JMAP email-header blob ID out-of-bounds index

  An authenticated user could attempt to download a specially crafted
  JMAP blob ID of the form "H<emailid>-<index>", which could read past
  the end of the internal blob_headers array during download, exposing
  adjacent heap memory.

  Reported by: Ahmed Said.

* CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL

  An authenticated DAV user with some shared access to another user's
  calendar or address book could read even unshared events or contacts
  by including the target hrefs in a calendar-multiget or addressbook-
  multiget REPORT.

  Reported by: Ahmed Said.

* CVE-2026-61910 Mailbox/set let sharee change special-use role on
  shared mailboxes

  An authenticated user with maySetKeywords on another user's mailbox
  could change that mailbox's specialuse annotation.  This could allow
  the sharee to change the shared mailbox to perform the archived,
  snoozed, or other role, which might cause mail mail to be written to
  the shared mailbox, sharing more content than intended.

  This is likely to be an unusual situation, made more unusual because
  if the target already has an non-shared mailbox with that role, role
  duplication suppression will prevent the update.

  Reported by: Michael Lynch (mtlynch.io).

* CVE-2026-61911 Sieve mailbox existence oracle

  An authenticated user could install a Sieve script that probed
  whether another user's private mailbox existed, or read the value of
  shared mailbox annotations, by observing which fileinto branch fired
  during LMTP delivery.

  Reported by: Michael Lynch (mtlynch.io).

* CVE-2026-61915: VPATCH BYPARAM double-free

  An authenticated calendar user could crash a Cyrus CalDAV worker
  with a PATCH containing "PATCH-ACTION="BYPARAM@..."" against a
  resource with two or more properties of the matched kind.  The
  memory holding the selector would be freed once on each iteration
  over the properties.

  Reported by: Michael Lynch (mtlynch.io).


Build changes
-------------

* Fixed: Issue #6142: build failure in lmtp_sieve on Alpine Linux


Bug fixes
---------

* Fixed: Issue #6064: escape JMAP logHeaders values before logging

* Fixed: Issue #6165: JMAP "EmailSubmission/set" now reports bad
  "rcptTo" values as "invalidRecipients" rather than
  "invalidProperties"

* Fixed: Issue #6334: JMAP "CalendarEvent/set" crash when
  "participants.sendTo" malformed
