Detections
Analytics
Debian dla-4766 : cyrus-admin - security update
medium Nessus Plugin ID 342180
Language:
Synopsis
The remote Debian host is missing one or more security-related updates.Description
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4766 advisory.- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard September 01, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : cyrus-imapd Version : 3.6.1-4+deb12u5 CVE ID : CVE-2026-47081 CVE-2026-47082 CVE-2026-47084 CVE-2026-47085 CVE-2026-47086 CVE-2026-47087 CVE-2026-47088 CVE-2026-47089
Several vulnerabilities were discovered in cyrus-imapd, a highly scalable mail store with support for IMAP, JMAP, POP3, CalDAV and CardDAV. Most of them allow authenticated users to bypass access control lists (ACL) and to access or modify other users' mailboxes.
CVE-2026-47081
The XAPPLEPUSHSERVICE command allowed an authenticated user to probe for the existence of other users' mailboxes and to hijack their push notifications.
CVE-2026-47082
Delivery of the Sieve vacation fcc copy skipped the ACL check on the destination mailbox, allowing a user to write messages into a mailbox they have no rights on.
CVE-2026-47084
The LOCALDELETE command bypassed ACL checks, allowing non-admin users to delete mailboxes they are not permitted to delete.
CVE-2026-47085
URLAUTH tokens could be forged because a predictable empty mboxkey was accepted, giving unauthorized access to message content.
CVE-2026-47086
The GENURLAUTH command issued URLAUTH tokens without checking the ACL_READ right on the target mailbox.
CVE-2026-47087
URLAUTH tokens remained valid after the access rights of the user who issued them had been revoked.
CVE-2026-47088
A heap out-of-bounds read was possible when parsing nested MIME comments in RFC 822 headers, which may lead to a denial of service.
CVE-2026-47089
The LISTRIGHTS command was not restricted to users having admin rights on the target mailbox, disclosing the ACL of other users' mailboxes.
These issues were fixed upstream in Cyrus IMAP 3.10.3 and have been backported to the 3.6 branch, which upstream no longer supports.
For Debian 12 bookworm, these problems have been fixed in version 3.6.1-4+deb12u5.
We recommend that you upgrade your cyrus-imapd packages.
For the detailed security status of cyrus-imapd please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/cyrus-imapd
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the cyrus-admin packages.See Also
https://packages.debian.org/source/bookworm/cyrus-imapd
https://security-tracker.debian.org/tracker/CVE-2026-47081
https://security-tracker.debian.org/tracker/CVE-2026-47082
https://security-tracker.debian.org/tracker/CVE-2026-47084
https://security-tracker.debian.org/tracker/CVE-2026-47085
https://security-tracker.debian.org/tracker/CVE-2026-47086
https://security-tracker.debian.org/tracker/CVE-2026-47087
https://security-tracker.debian.org/tracker/CVE-2026-47088
Plugin Details
Severity: Medium
ID: 342180
File Name: debian_DLA-4766.nasl
Version: 1.1
Type: Local
Agent: unix
Family: Debian Local Security Checks
Published: 9/1/2026
Updated: 9/1/2026
Supported Sensors: Continuous Assessment, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.05
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N
CVSS Score Source: CVE-2026-47084
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:cyrus-admin, p-cpe:/a:debian:debian_linux:cyrus-caldav, p-cpe:/a:debian:debian_linux:cyrus-clients, p-cpe:/a:debian:debian_linux:cyrus-common, p-cpe:/a:debian:debian_linux:cyrus-dev, p-cpe:/a:debian:debian_linux:cyrus-doc, p-cpe:/a:debian:debian_linux:cyrus-imapd, p-cpe:/a:debian:debian_linux:cyrus-murder, p-cpe:/a:debian:debian_linux:cyrus-nntpd, p-cpe:/a:debian:debian_linux:cyrus-pop3d, p-cpe:/a:debian:debian_linux:cyrus-replication, p-cpe:/a:debian:debian_linux:libcyrus-imap-perl
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 9/1/2026
Vulnerability Publication Date: 7/16/2026
Reference Information
CVE: CVE-2026-47081, CVE-2026-47082, CVE-2026-47084, CVE-2026-47085, CVE-2026-47086, CVE-2026-47087, CVE-2026-47088, CVE-2026-47089