{"id":"CVE-2021-32056","details":"Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.","modified":"2026-07-08T05:59:43.026454372Z","published":"2021-05-10T14:15:07.577Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"34"},{"last_affected":"34"},{"introduced":"35"},{"last_affected":"35"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEO3RURJW6NLIXS7NK5PVU6MGHC4SCM/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJZB45QBUN7CZFGOWCZYUYACNBTX7LVS/"},{"type":"FIX","url":"https://cyrus.topicbox.com/groups/announce/T056901c106ecfce3/cyrus-imap-3-4-1-released"},{"type":"FIX","url":"https://cyrus.topicbox.com/groups/announce/T126392718bc29d6b/cyrus-imap-3-2-7-released"},{"type":"FIX","url":"https://www.cyrusimap.org/imap/download/release-notes/3.2/x/3.2.7.html"},{"type":"FIX","url":"https://www.cyrusimap.org/imap/download/release-notes/3.4/x/3.4.1.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cyrusimap/cyrus-imapd","events":[{"introduced":"0"},{"fixed":"5b2529a1982c2fe8a91254845ecbe94f431382f3"},{"introduced":"749fec4ef971286b9a2d3bbccfb232b0a856888e"},{"fixed":"81629293ca4ced90bde67bc488e7c26537735adb"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.2.7"},{"introduced":"3.3.0"},{"fixed":"3.4.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*"}}],"versions":["cyrus-imapd-3.4.0","cyrus-imapd-3.4.0-rc1","cyrus-imapd-3.2.6","cyrus-imapd-3.4.0-beta3","cyrus-imapd-3.4.0-beta2","cyrus-imapd-3.4.0-beta1","cyrus-imapd-3.4.0-alpha0","cyrus-imapd-3.2.5","cyrus-imapd-3.3.1","cyrus-imapd-3.2.4","cyrus-imapd-3.2.3","cyrus-imapd-3.3.0","cyrus-imapd-3.2.2","cyrus-imapd-3.2.1","cyrus-imapd-3.2.0","cyrus-imapd-3.2.0-rc1","cyrus-imapd-3.2.0-beta4","cyrus-imapd-3.2.0-beta3","cyrus-imapd-3.2.0-beta2","cyrus-imapd-3.2.0-beta1","cyrus-imapd-3.2.0-beta0","cyrus-imapd-3.1.9","cyrus-imapd-3.1.8","cyrus-imapd-3.1.7","cyrus-imapd-3.1.6","cyrus-imapd-3.1.5","cyrus-imapd-3.1.4","cyrus-imapd-3.1.3","cyrus-imapd-3.1.2","cyrus-imapd-3.1.1","cyrus-imapd-3.0.0-rc4","cyrus-imapd-3.1.0-dev","cyrus-imapd-3.0.0-rc3","cyrus-imapd-3.0.0-rc2","cyrus-imapd-3.0.0-rc1","cyrus-imapd-3.0.0-beta6","cyrus-imapd-3.0.0-beta5","cyrus-imapd-3.0.0-beta4","cyrus-imapd-3.0.0-beta3","cyrus-imapd-3.0.0-beta2","cyrus-imapd-3.0.0-beta1","posttab","pretab","cyrus-imapd-2.5-snapshot-autoconf-and-automake","cyrus-imapd-2.4.2","cyrus-imapd-2.4.1","cyrus-imapd-2.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32056.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}]}