Logo
Retour à la veille

CVE-2026-61907

Publié : 9 septembre 2026
Modifié : 9 septembre 2026
Lien officiel NVD
Score CVSS
4.3
MEDIUM

Description détaillée

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Références et Patchs

https://cyrusimap.orghttps://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.htmlhttps://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.htmlhttps://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html

Dernières Vulnérabilités

CVE-2026-71616

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab.

VOIR DÉTAILS

CVE-2026-71614

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938.

VOIR DÉTAILS

CVE-2026-71613

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_process() function. Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859.

VOIR DÉTAILS