CVE-2021-32056: Cyrus Imap

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.

Affected products

• Cyrus Imap: before 3.2.7 (fixed in 3.2.7); from 3.3.0, before 3.4.1 (fixed in 3.4.1)
• Fedoraproject Fedora: version 34 only; version 35 only

Published 2021-05-10. Last modified 2026-06-17.