PatchTheCVE: cyrushttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-61915: An issue was discovered in Cyrus IMAP before 3.12.4https://patchthecve.com/cve/CVE-2026-61915.htmlhttps://patchthecve.com/cve/CVE-2026-61915.htmlWed, 16 Sep 2026 15:23:51 +0000MEDIUM 4.2: An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the sCVE-2026-61911: An issue was discovered in Cyrus IMAP before 3.12.4https://patchthecve.com/cve/CVE-2026-61911.htmlhttps://patchthecve.com/cve/CVE-2026-61911.htmlWed, 16 Sep 2026 15:23:58 +0000MEDIUM 4.3: An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired durCVE-2026-61910: An issue was discovered in Cyrus IMAP before 3.12.4https://patchthecve.com/cve/CVE-2026-61910.htmlhttps://patchthecve.com/cve/CVE-2026-61910.htmlWed, 16 Sep 2026 15:24:04 +0000LOW 3.5: An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailboxCVE-2026-61909: An issue was discovered in Cyrus IMAP before 3.12.4https://patchthecve.com/cve/CVE-2026-61909.htmlhttps://patchthecve.com/cve/CVE-2026-61909.htmlWed, 16 Sep 2026 15:24:24 +0000LOW 3.5: An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addreCVE-2026-61908: An issue was discovered in Cyrus IMAP before 3.12.4https://patchthecve.com/cve/CVE-2026-61908.htmlhttps://patchthecve.com/cve/CVE-2026-61908.htmlWed, 16 Sep 2026 15:24:33 +0000LOW 3.1: An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during downlo