Bug#1142925: trixie-pu: package cyrus-imapd/3.10.2-1+deb13u2

diff -Nru cyrus-imapd-3.10.2/debian/changelog cyrus-imapd-3.10.2/debian/changelog
--- cyrus-imapd-3.10.2/debian/changelog	2026-07-12 21:29:05.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/changelog	2026-08-02 12:00:00.000000000 +0200
@@ -1,3 +1,31 @@
+cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=high
+
+  * Backport security fixes from upstream 3.10.3 (Closes: #1142925)
+    (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html):
+    - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin
+      users to delete mailboxes without permission.
+    - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking
+      ACL_READ on the target mailbox.
+    - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's
+      access was revoked.
+    - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox
+      existence and hijacking push notifications on other users' folders.
+    - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin
+      access on the target mailbox.
+    - CVE-2026-47085: URLAUTH tokens could be forged via a predictable
+      empty mboxkey.
+    - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and
+      content enumeration oracle.
+    - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME
+      comments in RFC 822 headers.
+    - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the
+      destination mailbox.
+  * This revision adds DEP-3 metadata to the new patches and restores
+    upstream Cassandane regression tests that were missing from the initial
+    debdiff (thanks, Codin!) for several of the fixes.
+
+ -- Edmund Lodewijks <[email protected]>  Sun, 02 Aug 2026 12:00:00 +0200
+
 cyrus-imapd (3.10.2-1+deb13u1) trixie; urgency=medium
 
   * http_jmap: allow JMAP EventSource without WebSocket/wslay; backport
diff -Nru cyrus-imapd-3.10.2/debian/patches/0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch cyrus-imapd-3.10.2/debian/patches/0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch
--- cyrus-imapd-3.10.2/debian/patches/0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,101 @@
+Description: lmtp_sieve.c: enforce ACL on vacation :fcc destination (CVE-2026-47082)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2892, CVE-2026-47082.
+ .
+ Enforce *some* ACL check when delivering the fcc for a vacation message!
+ Rather than pass aclcheck=0, pass ACL_INSERT: the script owner must be
+ able to write to the target mailbox.
+ .
+ This problem was reported by Michael Lynch (mtlynch.io).
+ .
+ Co-authored-by: Claude <[email protected]>
+Author: Ricardo Signes <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/db6d646d00
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47082
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47082
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+diff --git a/cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied b/cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied
+new file mode 100644
+index 0000000..ed9ff9a
+--- /dev/null
++++ b/cassandane/tiny-tests/Sieve/vacation_with_fcc_otheruser_denied
+@@ -0,0 +1,58 @@
++#!perl
++use Cassandane::Tiny;
++
++sub test_vacation_with_fcc_otheruser_denied
++    :min_version_3_1
++    :NoAltNameSpace
++    :want_smtpdaemon
++{
++    my ($self) = @_;
++
++    my $target = "user.other.target";
++
++    xlog $self, "Create victim user 'other' and a target folder";
++    $self->{instance}->create_user('other');
++
++    my $admintalk = $self->{adminstore}->get_client();
++    $admintalk->create($target)
++        or die "Cannot create $target: $@";
++
++    xlog $self, "Give cassandane read-only access (no 'i'/'p' rights)";
++    $admintalk->setacl($target, 'cassandane' => 'lrs');
++    $self->assert_str_equals('ok',
++        $admintalk->get_last_completion_response());
++
++    xlog $self, "Confirm cassandane cannot APPEND directly to $target";
++    my $talk = $self->{store}->get_client();
++    $talk->append($target,
++        "From: nobody\@example.com\r\n"
++        . "Subject: direct-append\r\n\r\n"
++        . "denied\r\n");
++    $self->assert_str_equals('no',
++        $talk->get_last_completion_response());
++
++    xlog $self, "Install a vacation rule that :fcc's into the victim's folder";
++    $self->{instance}->install_sieve_script(<<EOF
++require ["vacation", "fcc"];
++
++vacation :fcc "$target" :days 1 :addresses ["cassandane\@example.com"] text:
++I am out of the office today. I will answer your email as soon as I can.
++.
++;
++EOF
++    );
++
++    xlog $self, "Deliver a message to trigger the vacation auto-reply";
++    my $msg1 = $self->{gen}->generate(
++        subject => "Message 1",
++        to => Cassandane::Address->new(localpart => 'cassandane',
++                                       domain => 'example.com'),
++    );
++    $self->{instance}->deliver($msg1);
++
++    xlog $self, "Check that nothing was filed into the victim's folder";
++    $admintalk->select($target);
++    $self->assert_str_equals('ok',
++        $admintalk->get_last_completion_response());
++    $self->assert_num_equals(0, $admintalk->get_response_code('exists'));
++}
+diff --git a/imap/lmtp_sieve.c b/imap/lmtp_sieve.c
+index f13a266..b85bf1a 100644
+--- a/imap/lmtp_sieve.c
++++ b/imap/lmtp_sieve.c
+@@ -1931,7 +1931,7 @@ static void do_fcc(script_data_t *sdata, sieve_fileinto_context_t *fcc,
+     }
+     if (!r) {
+         r = append_setup(&as, intname, userid, sdata->authstate,
+-                         0, NULL, NULL, 0, EVENT_MESSAGE_APPEND);
++                         ACL_INSERT, NULL, NULL, 0, EVENT_MESSAGE_APPEND);
+     }
+     if (!r) {
+         struct stagemsg *stage;
diff -Nru cyrus-imapd-3.10.2/debian/patches/0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch cyrus-imapd-3.10.2/debian/patches/0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch
--- cyrus-imapd-3.10.2/debian/patches/0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,145 @@
+Description: imap/message.c: fix heap exposure in nested MIME comment parsing (CVE-2026-47088)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2882, CVE-2026-47088.
+ .
+ Fix out-of-bounds read in message_parse_rfc822space() when parsing RFC
+ 822 comments that end with backslash. The backslash case would increment
+ p past a NUL terminator, and the subsequent loop increment would read
+ into adjacent heap memory.
+ .
+ Add bounds check after backslash handling to prevent reading past the
+ end of the buffer.
+ .
+ This problem was reported by Michael Lynch (mtlynch.io).
+ .
+ Co-Authored-By: Claude <[email protected]>
+Author: Ricardo Signes <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/23495997b5
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47088
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47088
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+diff --git a/cassandane/Cassandane/Cyrus/MIME.pm b/cassandane/Cassandane/Cyrus/MIME.pm
+new file mode 100644
+index 0000000..58df5a2
+--- /dev/null
++++ b/cassandane/Cassandane/Cyrus/MIME.pm
+@@ -0,0 +1,40 @@
++# SPDX-License-Identifier: BSD-3-Clause-CMU
++# See COPYING file at the root of the distribution for more details.
++
++package Cassandane::Cyrus::MIME;
++use strict;
++use warnings;
++use Data::Dumper;
++
++use base qw(Cassandane::Cyrus::TestCase);
++use Cassandane::Util::Log;
++
++sub new
++{
++    my ($class, @args) = @_;
++
++    my $config = Cassandane::Config->default()->clone();
++
++    my $self = $class->SUPER::new({
++        config => $config,
++        services => [ 'imap' ]
++    }, @args);
++
++    return $self;
++}
++
++sub set_up
++{
++    my ($self) = @_;
++    $self->SUPER::set_up();
++}
++
++sub tear_down
++{
++    my ($self) = @_;
++    $self->SUPER::tear_down();
++}
++
++use Cassandane::Tiny::Loader 'tiny-tests/MIME';
++
++1;
+diff --git a/cassandane/tiny-tests/MIME/nested_comment_oob b/cassandane/tiny-tests/MIME/nested_comment_oob
+new file mode 100644
+index 0000000..b47f6b1
+--- /dev/null
++++ b/cassandane/tiny-tests/MIME/nested_comment_oob
+@@ -0,0 +1,50 @@
++#!perl
++use Cassandane::Tiny;
++
++sub test_nested_comment_oob
++{
++    my ($self) = @_;
++
++    my $talk = $self->{store}->get_client();
++
++    # Create a multipart message where the vulnerability is in a nested part.
++    # Based on the PoC description, this reproduces the backslash handling bug
++    # in message_parse_rfc822space() when parsing nested Content-Type headers.
++    # The malformed header must be the last content to ensure backslash is final byte.
++    my $msg = <<'EOF';
++From: [email protected]
++To: [email protected]
++Subject: Test heap disclosure
++Content-Type: multipart/mixed; boundary="BOUNDARY"
++
++--BOUNDARY
++Content-Type: text/plain
++
++This is a normal part.
++
++--BOUNDARY
++Content-Type: text/plain (\
++EOF
++
++    # Remove trailing newline so backslash is the final byte before NUL
++    chomp $msg;
++    $msg =~ s/\r?\n/\r\n/gs;
++
++    # Append the message
++    $talk->append('INBOX', $msg) || die $@;
++
++    # Select the mailbox
++    $talk->select('INBOX');
++    $self->assert_str_equals('ok', $talk->get_last_completion_response());
++
++    # Fetch BODYSTRUCTURE - this exercises the vulnerable MIME parsing code
++    # In vulnerable versions, this may crash or leak heap data as MIME parameters
++    my $response = $talk->fetch('1', 'BODYSTRUCTURE');
++    $self->assert_str_equals('ok', $talk->get_last_completion_response());
++
++    # Log the bodystructure for manual inspection of any anomalies
++    # In a release build with heap spray, unexpected parameters may appear
++    if ($response && $response->{1} && $response->{1}->{bodystructure}) {
++        xlog $self, "BODYSTRUCTURE: " . Data::Dumper::Dumper($response->{1}->{bodystructure});
++    }
++}
+diff --git a/imap/message.c b/imap/message.c
+index a5b633e..f18b1c6 100644
+--- a/imap/message.c
++++ b/imap/message.c
+@@ -1768,6 +1768,10 @@ static void message_parse_rfc822space(const char **s)
+ 
+                 case '\\':
+                     p++;
++                    if (*p == '\0') {
++                        *s = 0;     /* backslash at end of string */
++                        return;
++                    }
+                     break;
+ 
+                 case '(':
diff -Nru cyrus-imapd-3.10.2/debian/patches/0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch cyrus-imapd-3.10.2/debian/patches/0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch
--- cyrus-imapd-3.10.2/debian/patches/0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,96 @@
+Description: imapd: MULTISEARCH must check ACL_READ on each mailbox (CVE-2026-47083)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2881, CVE-2026-47083.
+ .
+ multisearch_cb opened caller-supplied mailboxes from
+ MAILBOXES/SUBTREE/SUBTREE-ONE and ran index_search on them without
+ checking whether the caller could read the mailbox. SELECT has the
+ equivalent gate (imapd.c:5001); MULTISEARCH did not.
+ .
+ The effect is a cross-user read oracle: SUBTREE on another user's
+ account returns one `* ESEARCH ... MAILBOX "..."` line per folder
+ (folder enumeration for free), and BODY/SUBJECT predicates then probe
+ the contents one search at a time. An attacker only needs to be able
+ to name a target mailbox.
+ .
+ This problem was reported by Michael Lynch (mtlynch.io).
+ .
+ Co-Authored-By: Claude <[email protected]>
+Author: Ricardo Signes <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/0534c4e30a
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47083
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47083
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+diff --git a/cassandane/Cassandane/Cyrus/Search.pm b/cassandane/Cassandane/Cyrus/Search.pm
+index 19e16fa..d9e5e9e 100644
+--- a/cassandane/Cassandane/Cyrus/Search.pm
++++ b/cassandane/Cassandane/Cyrus/Search.pm
+@@ -757,4 +757,44 @@ sub test_uidsearch_empty
+     $self->assert_str_equals('0', $results[0][3]);
+ }
+ 
++sub test_multisearch_cross_user
++    :NoAltNamespace
++{
++    my ($self) = @_;
++
++    my $admintalk = $self->{adminstore}->get_client;
++    my $talk = $self->{store}->get_client;
++
++    # victim has a private subfolder with a message. cassandane has no
++    # explicit grant on it, only whatever the "anyone p" default provides --
++    # i.e. ACL_POST, which is not enough to run a search.
++    $self->{instance}->create_user('victim');
++
++    $admintalk->create('user.victim.private')
++        || die "create: " . $admintalk->get_last_error;
++
++    $admintalk->append(
++        'user.victim.private',
++        "From: t\@example.com\r\nSubject: secret\r\n\r\nconfidential body",
++    ) || die "append: " . $admintalk->get_last_error;
++
++    # Check our assumptions: default user has no access to victim's private
++    # folder.
++    $talk->select('user.victim.private');
++    $self->assert_str_equals('no', $talk->get_last_completion_response);
++
++    # The actual test: assert that cassandane user can't find anything by
++    # ESEARCHing victim's private mailbox.
++    my @esearch_responses;
++    $talk->_imap_cmd(
++        'ESEARCH', 0,
++        { esearch => sub { push @esearch_responses, $_[1] } },
++        'IN', '(MAILBOXES "user.victim.private")',
++        'RETURN', '(ALL)', 'ALL',
++    );
++
++    $self->assert_str_equals('ok', $talk->get_last_completion_response);
++    $self->assert_deep_equals([], \@esearch_responses);
++}
++
+ 1;
+diff --git a/imap/imapd.c b/imap/imapd.c
+index f7be33e..4edd0bf 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -6076,6 +6076,11 @@ static int multisearch_cb(const mbentry_t *mbentry, void *rock)
+         hash_lookup(mbentry->name, &mrock->mailboxes))
+         return 0;
+ 
++    /* Skip mailboxes the caller can't read. */
++    if (!imapd_userisadmin &&
++        !(cyrus_acl_myrights(imapd_authstate, mbentry->acl) & ACL_READ))
++        return 0;
++
+     switch (mrock->filter) {
+     case SEARCH_SOURCE_INBOXES:
+         /* Only allow user's INBOX or those postable by anonymous */
diff -Nru cyrus-imapd-3.10.2/debian/patches/0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch cyrus-imapd-3.10.2/debian/patches/0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch
--- cyrus-imapd-3.10.2/debian/patches/0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,121 @@
+Description: imapd: reject URLFETCH when no mboxkey exists for the mailbox (CVE-2026-47085)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2876, CVE-2026-47085.
+ .
+ Instead of treating "there's no mboxkey.db entry for this folder" as
+ indicating a zero-length key, treat a missing mboxkey entry as a
+ validation failure.
+ .
+ (Also close the mboxkey db on the previously-unclosed error paths.)
+ .
+ This problem reported by Matthew Horsfall.
+ .
+ Co-Authored-By: Claude <[email protected]>
+ .
+ Cherry-picked from upstream commits:
+   e5a1055614 cassandane: test for URLFETCH token forgery with empty mboxkey
+   1d39d32c3b imapd: reject URLFETCH when no mboxkey exists for the mailbox
+Author: Ricardo Signes <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/1d39d32c3b
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47085
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47085
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+Index: cyrus-imapd/cassandane/Cassandane/Cyrus/URLAuth.pm
+===================================================================
+--- cyrus-imapd.orig/cassandane/Cassandane/Cyrus/URLAuth.pm
++++ cyrus-imapd/cassandane/Cassandane/Cyrus/URLAuth.pm
+@@ -44,6 +44,7 @@ use Cwd qw(abs_path);
+ use File::Path qw(mkpath);
+ use DateTime;
+ use Data::Dumper;
++use Digest::SHA qw(hmac_sha1_hex);
+ 
+ use lib '.';
+ use base qw(Cassandane::Cyrus::TestCase);
+@@ -161,4 +162,57 @@ sub test_urlfetch
+     $self->assert_str_equals($data, "ody");
+ }
+ 
++sub test_forged_empty_key
++    :UnixHierarchySep :AltNamespace
++{
++    my ($self) = @_;
++
++    # The victim has an INBOX and a second folder.  The secret we don't want
++    # leaked lives in the second folder.
++    my $talk = $self->{store}->get_client;
++    $talk->create("Archive") or die "create Archive: " . $talk->get_last_error;
++
++    $self->{store}->set_folder("INBOX");
++    $self->make_message("Public INBOX message");
++
++    $self->{store}->set_folder("Archive");
++    $self->make_message("Secret archived message");
++
++    # Cause the victim's mboxkey.db to be created, but with an entry only for
++    # the INBOX -- *not* for the Archive folder we're about to attack.  An
++    # mboxkey.db appears in the wild whenever a user has ever issued a
++    # GENURLAUTH (or a RESETKEY for a specific mailbox).
++    my $seed;
++    $talk->_imap_cmd(
++        'genurlauth', 0,
++        { genurlauth => sub { $seed = $_[1]->[0] } },
++        'imap://[email protected]/INBOX/;uid=1;urlauth=user+cassandane',
++        'INTERNAL',
++    );
++    $self->assert_not_null($seed, 'victim should be able to URLAUTH their own INBOX');
++
++    # Now the attacker forges a token for the *Archive* folder.  Because
++    # mboxkey_read() returns {key=NULL, keylen=0} for any mailbox it has never
++    # stored, cmd_urlfetch computes HMAC-SHA1 with an empty key -- which is
++    # entirely attacker-computable.
++    $self->{instance}->create_user('attacker');
++
++    my $rump = 'imap://[email protected]/Archive/;uid=1;urlauth=user+attacker';
++    my $token = '00' . hmac_sha1_hex($rump, '');
++    my $forged = "$rump:internal:$token";
++
++    my $svc = $self->{instance}->get_service('imap');
++    my $store = $svc->create_store(username => 'attacker');
++    my $attacker = $store->get_client();
++
++    my $stolen;
++    $attacker->_imap_cmd(
++        'urlfetch', 0,
++        { urlfetch => sub { $stolen = $_[1]->[1] } },
++        $forged,
++    );
++
++    $self->assert_null($stolen);
++}
++
+ 1;
+Index: cyrus-imapd/imap/imapd.c
+===================================================================
+--- cyrus-imapd.orig/imap/imapd.c
++++ cyrus-imapd/imap/imapd.c
+@@ -14061,7 +14061,15 @@ static void cmd_urlfetch(char *tag)
+                 if (r) break;
+ 
+                 r = mboxkey_read(mboxkey_db, intname, &key, &keylen);
+-                if (r) break;
++                if (!r && (!key || !keylen)) {
++                    /* If there's no key, we can't possibly validate against
++                     * it! */
++                    r = IMAP_BADURL;
++                }
++                if (r) {
++                    mboxkey_close(mboxkey_db);
++                    break;
++                }
+ 
+                 HMAC(EVP_sha1(), key, keylen, (unsigned char *) arg.s,
+                      url.urlauth.rump_len, vtoken, &vtoken_len);
diff -Nru cyrus-imapd-3.10.2/debian/patches/0024-imapd-LISTRIGHTS-requires-admin-rights.patch cyrus-imapd-3.10.2/debian/patches/0024-imapd-LISTRIGHTS-requires-admin-rights.patch
--- cyrus-imapd-3.10.2/debian/patches/0024-imapd-LISTRIGHTS-requires-admin-rights.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0024-imapd-LISTRIGHTS-requires-admin-rights.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,85 @@
+Description: imapd: LISTRIGHTS requires admin rights (CVE-2026-47089)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2872, CVE-2026-47089.
+ .
+ cmd_listrights was refusing only when the caller had *no* rights at
+ all on the target mailbox, when it should've been requiring admin
+ rights.
+ .
+ With this patch, we'll properly require ACL_ADMIN (owners and admins
+ still pass through), matching the check cmd_getacl already uses.  When
+ the caller has ACL_LOOKUP but not ACL_ADMIN, return PERMISSION_DENIED;
+ otherwise hide the mailbox as NONEXISTENT.
+ .
+ This problem reported by Matthew Horsfall.
+ .
+ Co-Authored-By: Claude <[email protected]>
+ .
+ Cherry-picked from upstream commits:
+   5f406195f7 cassandane: test that LISTRIGHTS requires admin rights
+   5c97794e52 imapd: LISTRIGHTS requires admin rights
+Author: Ricardo Signes <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/5c97794e52
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47089
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47089
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+diff --git a/cassandane/Cassandane/Cyrus/ACL.pm b/cassandane/Cassandane/Cyrus/ACL.pm
+index 62fef8e..64ca817 100644
+--- a/cassandane/Cassandane/Cyrus/ACL.pm
++++ b/cassandane/Cassandane/Cyrus/ACL.pm
+@@ -270,6 +270,30 @@ sub test_setacl_badrights
+     $self->assert_deep_equals($origacl, $newacl);
+ }
+ 
++sub test_listrights_other_user
++{
++    my ($self) = @_;
++
++    my $talk = $self->{store}->get_client;
++
++    # Create a victim user.  We grant the attacker no explicit rights on the
++    # victim's mailbox: the default ACL "anyone p" is enough to expose the
++    # bug.  (LISTRIGHTS gates only on "has any right at all", where it ought
++    # to require ACL_ADMIN; ACL_POST from the anyone grant is sufficient to
++    # slip past.)
++    $self->{instance}->create_user('victim');
++
++    my $seen;
++    $talk->_imap_cmd(
++        'LISTRIGHTS', 0,
++        { listrights => sub { $seen = 1 } },
++        'Other Users.victim', 'victim',
++    );
++
++    $self->assert_str_equals('no', $talk->get_last_completion_response);
++    $self->assert_null($seen);
++}
++
+ # see also LDAP.pm for groupid tests
+ 
+ 1;
+diff --git a/imap/imapd.c b/imap/imapd.c
+index 6aca6f4..703d835 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -8520,9 +8520,10 @@ static void cmd_listrights(char *tag, char *name, char *identifier)
+     if (!r) {
+         rights = cyrus_acl_myrights(imapd_authstate, mbentry->acl);
+ 
+-        if (!rights && !imapd_userisadmin &&
++        if (!(rights & ACL_ADMIN) && !imapd_userisadmin &&
+             !mboxname_userownsmailbox(imapd_userid, intname)) {
+-            r = IMAP_MAILBOX_NONEXISTENT;
++            r = (rights & ACL_LOOKUP) ?
++                IMAP_PERMISSION_DENIED : IMAP_MAILBOX_NONEXISTENT;
+         }
+     }
+ 
diff -Nru cyrus-imapd-3.10.2/debian/patches/0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch cyrus-imapd-3.10.2/debian/patches/0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch
--- cyrus-imapd-3.10.2/debian/patches/0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,130 @@
+Description: imapd: require read access for XAPPLEPUSHSERVICE mailboxes (CVE-2026-47081)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2871, CVE-2026-47081.
+ .
+ Only accept a mailbox if the caller is its owner, an admin, or holds
+ ACL_READ. Anything else is silently skipped (no echo, no event), which
+ also preserves the existing "missing" behaviour for non-existent names.
+ .
+ This problem reported by Matthew Horsfall.
+ .
+ Co-Authored-By: Claude <[email protected]>
+ .
+ Cherry-picked from upstream commits:
+   1044c0b13b cassandane: test XAPPLEPUSHSERVICE leaks other users' folders
+   50f77bad30 imapd: require read access for XAPPLEPUSHSERVICE mailboxes
+Author: Ricardo Signes <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/50f77bad30
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47081
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47081
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+diff --git a/cassandane/Cassandane/Cyrus/XApplePushService.pm b/cassandane/Cassandane/Cyrus/XApplePushService.pm
+new file mode 100644
+index 0000000..497d505
+--- /dev/null
++++ b/cassandane/Cassandane/Cyrus/XApplePushService.pm
+@@ -0,0 +1,40 @@
++# SPDX-License-Identifier: BSD-3-Clause-CMU
++# See COPYING file at the root of the distribution for more details.
++
++package Cassandane::Cyrus::XApplePushService;
++use strict;
++use warnings;
++
++use base qw(Cassandane::Cyrus::TestCase);
++use Cassandane::Util::Log;
++
++sub new
++{
++    my ($class, @args) = @_;
++
++    my $config = Cassandane::Config->default()->clone();
++    $config->set(event_groups => 'applepushservice');
++    $config->set(aps_topic => 'mail');
++
++    return $class->SUPER::new({
++        adminstore => 1,
++        config => $config,
++        services => ['imap'],
++    }, @args);
++}
++
++sub set_up
++{
++    my ($self) = @_;
++    $self->SUPER::set_up();
++}
++
++sub tear_down
++{
++    my ($self) = @_;
++    $self->SUPER::tear_down();
++}
++
++use Cassandane::Tiny::Loader 'tiny-tests/XApplePushService';
++
++1;
+diff --git a/cassandane/tiny-tests/XApplePushService/leak_other_user b/cassandane/tiny-tests/XApplePushService/leak_other_user
+new file mode 100644
+index 0000000..ec75872
+--- /dev/null
++++ b/cassandane/tiny-tests/XApplePushService/leak_other_user
+@@ -0,0 +1,34 @@
++#!perl
++use Cassandane::Tiny;
++
++sub test_leak_other_user
++{
++    my ($self) = @_;
++
++    my $admintalk = $self->{adminstore}->get_client;
++    my $talk = $self->{store}->get_client;
++
++    # Create a victim user and a subfolder on their account.  The attacker
++    # holds nothing on it beyond the "anyone p" default ACL.
++    $self->{instance}->create_user('victim');
++    $admintalk->create('user.victim.bah') or die "create: " . $admintalk->get_last_error;
++
++    my @responses;
++    $talk->_imap_cmd(
++        'XAPPLEPUSHSERVICE', 0,
++        { xapplepushservice => sub { push @responses, [ @{$_[1]} ] } },
++        'mailboxes',         [ 'Other Users.victim.bah' ],
++        'aps-version',       '2',
++        'aps-account-id',    'accountid',
++        'aps-device-token',  'devtoken',
++        'aps-subtopic',      'subtopic',
++    );
++
++    # Every invocation of XAPPLEPUSHSERVICE gets the trailing "aps-version"
++    # status response; that's fine.  What must not appear is a
++    # * XAPPLEPUSHSERVICE "mailbox" "<name>" echo, which both confirms the
++    # mailbox exists and (via mboxevent_set_applepushservice) subscribes
++    # the attacker's APNS device to the victim's mail.
++    my @mailbox_echoes = grep { ($_->[0] // '') eq 'mailbox' } @responses;
++    $self->assert_deep_equals([], \@mailbox_echoes);
++}
+diff --git a/imap/imapd.c b/imap/imapd.c
+index 3b3d36c..6aca6f4 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -14794,7 +14794,10 @@ static void cmd_xapplepushservice(const char *tag,
+         char *intname =
+             mboxname_from_external(name, &imapd_namespace, imapd_userid);
+         r = mlookup(tag, name, intname, &mbentry);
+-        if (!r && mbtype_isa(mbentry->mbtype) == MBTYPE_EMAIL) {
++        if (!r && mbtype_isa(mbentry->mbtype) == MBTYPE_EMAIL &&
++            (imapd_userisadmin ||
++             mboxname_userownsmailbox(imapd_userid, intname) ||
++             (cyrus_acl_myrights(imapd_authstate, mbentry->acl) & ACL_READ))) {
+             strarray_push(&notif_mailboxes, name);
+             if (applepushserviceargs->aps_version >= 2) {
+                 prot_puts(imapd_out, "* XAPPLEPUSHSERVICE \"mailbox\" ");
diff -Nru cyrus-imapd-3.10.2/debian/patches/0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch cyrus-imapd-3.10.2/debian/patches/0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch
--- cyrus-imapd-3.10.2/debian/patches/0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,127 @@
+Description: imapd.c: re-check URLAUTH authorizer access just in time (CVE-2026-47087)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2868, CVE-2026-47087.
+ .
+ cmd_urlfetch validated the HMAC token against the authorizer's mboxkey,
+ but skipped any ACL check whenever url.urlauth.access was set.  Sure,
+ the rights existed right at that moment, but if access is revoked after
+ the URL is created, the URL needs to stop working.  We need to just
+ check access JIT.
+ .
+ Co-Authored-By: Claude <[email protected]>
+ .
+ Cherry-picked from upstream commits:
+   be5eabb4df cassandane: tighten URLAuth ACL bypass test
+   fbb130b339 cassandane: fix indenting in cassandane/tiny-tests/URLAuth/perms
+   bdf709102c cassandane: URLAUTH must re-check authorizer ACLs at fetch time
+   8380d0fb3d imapd.c: re-check URLAUTH authorizer access just in time
+Author: Ricardo Signes <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/8380d0fb3d
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47087
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47087
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+Index: cyrus-imapd/cassandane/Cassandane/Cyrus/URLAuth.pm
+===================================================================
+--- cyrus-imapd.orig/cassandane/Cassandane/Cyrus/URLAuth.pm
++++ cyrus-imapd/cassandane/Cassandane/Cyrus/URLAuth.pm
+@@ -215,4 +215,61 @@ sub test_forged_empty_key
+     $self->assert_null($stolen);
+ }
+ 
++sub test_revoked_access_invalidates_url
++    :UnixHierarchySep :AltNamespace
++{
++    my ($self) = @_;
++
++    my $admintalk = $self->{adminstore}->get_client;
++
++    $self->{instance}->create_user('other');
++
++    $self->make_message("Secret Message");
++
++    # Grant 'other' read+lookup so that genurlauth will mint a token.
++    $admintalk->setacl('user/cassandane', 'other', 'lrs')
++        or die "setacl: " . $admintalk->get_last_error;
++
++    my $svc = $self->{instance}->get_service('imap');
++    my $store = $svc->create_store(username => 'other');
++    my $other_talk = $store->get_client();
++
++    # 'other' mints a URLAUTH token while authorized.
++    my $url;
++    $other_talk->_imap_cmd(
++        'genurlauth', 0,
++        { genurlauth => sub { $url = $_[1]->[0] } },
++        'imap://[email protected]/Other%20Users%2fcassandane/;uid=1;urlauth=user+other',
++        'INTERNAL',
++    );
++    $self->assert_not_null($url, 'genurlauth should succeed while authorized');
++
++    # Captured value is wrapped in quotes; strip them for urlfetch.
++    (my $bare_url = $url) =~ s/\A"(.*)"\z/$1/;
++
++    # Sanity check: the token works while access is in place.
++    my $data;
++    $other_talk->_imap_cmd(
++        'urlfetch', 0,
++        { urlfetch => sub { $data = $_[1]->[1] } },
++        $bare_url,
++    );
++    $self->assert_not_null($data, 'URL should fetch while authorizer is authorized');
++
++    # Revoke 'other's access entirely.
++    $admintalk->setacl('user/cassandane', 'other', '')
++        or die "setacl: " . $admintalk->get_last_error;
++
++    # The token is cryptographically intact, but the authorizer's right to
++    # delegate the message is gone. cmd_urlfetch must re-check ACLs at fetch
++    # time and refuse, instead of trusting the token alone.
++    my $stolen;
++    $other_talk->_imap_cmd(
++        'urlfetch', 0,
++        { urlfetch => sub { $stolen = $_[1]->[1] } },
++        $bare_url,
++    );
++    $self->assert_null($stolen, 'URL must not fetch after authorizer access revoked');
++}
++
+ 1;
+Index: cyrus-imapd/imap/imapd.c
+===================================================================
+--- cyrus-imapd.orig/imap/imapd.c
++++ cyrus-imapd/imap/imapd.c
+@@ -14108,6 +14108,26 @@ static void cmd_urlfetch(char *tag)
+         }
+         if (r) goto err;
+ 
++        /* For URLAUTH-protected URLs, re-check the authorizer's ACL.  The
++         * HMAC asserts that authorization DID exist, but may have since been
++         * revoked.  We can't read the ACL via state->mailbox here: when the
++         * URL targets the currently-selected mailbox we reuse imapd_index,
++         * whose mailbox handle is closed between commands. */
++        if (url.urlauth.access) {
++            mbentry_t *authz_mbentry = NULL;
++            r = mlookup(NULL, NULL, intname, &authz_mbentry);
++            if (!r) {
++                struct auth_state *authzstate = auth_newstate(url.user);
++                int authz_rights =
++                    cyrus_acl_myrights(authzstate, authz_mbentry->acl);
++                auth_freestate(authzstate);
++                if (!(authz_rights & ACL_READ))
++                    r = IMAP_BADURL;
++            }
++            mboxlist_entry_free(&authz_mbentry);
++            if (r) goto err;
++        }
++
+         if (url.uidvalidity &&
+            (state->mailbox->i.uidvalidity != url.uidvalidity)) {
+             r = IMAP_BADURL;
diff -Nru cyrus-imapd-3.10.2/debian/patches/0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch cyrus-imapd-3.10.2/debian/patches/0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch
--- cyrus-imapd-3.10.2/debian/patches/0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,107 @@
+Description: imapd: require read access on mailbox in GENURLAUTH (CVE-2026-47086)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2868, CVE-2026-47086.
+ .
+ You can't grant access to things you can't access!  Without this check,
+ any authenticated user could mint a URLAUTH token for any mailbox they
+ could name, because cmd_urlfetch skipped the ACL check whenever
+ urlauth.access is set -- it trusts that the presence of a valid HMAC
+ means the authorizing user was entitled to delegate.
+ .
+ Require the authorizer to have at least ACL_READ on the mailbox before
+ issuing a token.
+ .
+ This problem reported by Matthew Horsfall.
+ .
+ Co-Authored-By: Claude <[email protected]>
+ .
+ Cherry-picked from upstream commits:
+   88d9bf6e7e cassandane: test for ACL bypass in URLAuth
+   e7a28ccf9b imapd: require read access on mailbox in GENURLAUTH
+Author: Ricardo Signes <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/e7a28ccf9b
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47086
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47086
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+Index: cyrus-imapd/cassandane/Cassandane/Cyrus/URLAuth.pm
+===================================================================
+--- cyrus-imapd.orig/cassandane/Cassandane/Cyrus/URLAuth.pm
++++ cyrus-imapd/cassandane/Cassandane/Cyrus/URLAuth.pm
+@@ -272,4 +272,50 @@ sub test_revoked_access_invalidates_url
+     $self->assert_null($stolen, 'URL must not fetch after authorizer access revoked');
+ }
+ 
++sub test_perms
++    :UnixHierarchySep :AltNamespace
++{
++    my ($self) = @_;
++
++    $self->{instance}->create_user('other');
++
++  my $msg = $self->make_message("Message A");
++
++  my $url;
++  my %handlers = (
++    genurlauth => sub {
++      my ($cmd, $params) = @_;
++      $url = $params->[0];
++    }
++  );
++
++    my $svc = $self->{instance}->get_service('imap');
++    my $store = $svc->create_store(username => 'other');
++    my $talk = $store->get_client();
++
++  $talk->_imap_cmd(
++    'genurlauth', 0, \%handlers,
++    "imap://other\@127.0.0.1/Other%20Users%2fcassandane/;uid=1;urlauth=user+other",
++    "INTERNAL",
++  );
++
++  # This should fail in some way, commented out to show we really do fetch the
++  # email
++#  $self->assert_null($url);
++
++  my $email;
++  %handlers = (
++    urlfetch => sub {
++      my ($cmd, $params) = @_;
++      $email = ${$params}[1];
++    },
++  );
++
++  my $res = $talk->_imap_cmd('urlfetch', 0, \%handlers, $url);
++
++  warn $email if $email;
++
++  $self->assert_null($email);
++}
++
+ 1;
+Index: cyrus-imapd/imap/imapd.c
+===================================================================
+--- cyrus-imapd.orig/imap/imapd.c
++++ cyrus-imapd/imap/imapd.c
+@@ -14261,6 +14261,14 @@ static void cmd_genurlauth(char *tag)
+             continue;
+         }
+ 
++        /* You can't give permission you don't have! */
++        if (!imapd_userisadmin &&
++            !(cyrus_acl_myrights(imapd_authstate, mbentry->acl) & ACL_READ)) {
++            mboxlist_entry_free(&mbentry);
++            r = IMAP_BADURL;
++            goto err;
++        }
++
+         mboxlist_entry_free(&mbentry);
+ 
+         /* lookup key */
diff -Nru cyrus-imapd-3.10.2/debian/patches/0028-imapd-fix-cmd_delete-force-handling.patch cyrus-imapd-3.10.2/debian/patches/0028-imapd-fix-cmd_delete-force-handling.patch
--- cyrus-imapd-3.10.2/debian/patches/0028-imapd-fix-cmd_delete-force-handling.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/0028-imapd-fix-cmd_delete-force-handling.patch	2026-08-02 12:00:00.000000000 +0200
@@ -0,0 +1,116 @@
+Description: imapd: fix cmd_delete 'force' handling (LOCALDELETE ACL bypass) (CVE-2026-47084)
+ An initial debdiff for this CVE batch was submitted by Codin
+ <[email protected]> and sponsored/reviewed by Bastian Germann
+ <[email protected]> in Debian bug #1142925. This revision adds DEP-3
+ metadata and, where missing from that debdiff, folds in the matching
+ upstream Cassandane regression test(s).
+ .
+ This is CYR-2867, CVE-2026-47084.
+ .
+ Non-admin users could invoke the admin-only LOCALDELETE command
+ and delete mailboxes without permission, because MBOXLIST_DELETE_FORCE
+ wasn't being plumbed through to mboxlist_deletemailbox.
+ .
+ Reported by Michael Lynch (mtlynch.io).
+ .
+ Cherry-picked from upstream commits:
+   2c871deac5 Delete: test localdelete of other user's mailbox
+   304255f5be imapd: fix cmd_delete 'force' handling
+   7dfc43c681 MurderIMAP: localdelete requires admin privs
+Author: ellie timoney <[email protected]>
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/304255f5be
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-47084
+Bug-Debian: https://bugs.debian.org/1142925
+Bug-CVE: CVE-2026-47084
+Forwarded: not-needed
+Last-Update: 2026-07-25
+
+diff --git a/cassandane/Cassandane/Cyrus/Delete.pm b/cassandane/Cassandane/Cyrus/Delete.pm
+index 10f9fb6..fc778af 100644
+--- a/cassandane/Cassandane/Cyrus/Delete.pm
++++ b/cassandane/Cassandane/Cyrus/Delete.pm
+@@ -1085,4 +1085,30 @@ sub test_cyr_expire_delete_noexpire
+     $self->check_syslog($self->{instance});
+ }
+ 
++sub test_localdelete_other
++    :UnixHierarchySep :AltNamespace
++{
++    my ($self) = @_;
++
++    $self->{instance}->create_user("other");
++
++    my $admintalk = $self->{adminstore}->get_client();
++    $admintalk->create('user/other/foo');
++    $self->assert_str_equals('ok', $admintalk->get_last_completion_response());
++    $admintalk->setacl('user/other/foo', 'cassandane' => 'l');
++    $self->assert_str_equals('ok', $admintalk->get_last_completion_response());
++
++    my $imaptalk = $self->{store}->get_client();
++
++    # shouldn't be able to delete another user's mailbox
++    $imaptalk->delete('Other Users/other/foo');
++    $self->assert_str_equals('no', $imaptalk->get_last_completion_response());
++    $self->assert_matches(qr{Permission denied}, $imaptalk->get_last_error());
++
++    # shouldn't be able to localdelete it either!
++    $imaptalk->localdelete('Other Users/other/foo');
++    $self->assert_str_equals('no', $imaptalk->get_last_completion_response());
++    $self->assert_matches(qr{Permission denied}, $imaptalk->get_last_error());
++}
++
+ 1;
+diff --git a/cassandane/Cassandane/Cyrus/MurderIMAP.pm b/cassandane/Cassandane/Cyrus/MurderIMAP.pm
+index fbf631b..0a83897 100644
+--- a/cassandane/Cassandane/Cyrus/MurderIMAP.pm
++++ b/cassandane/Cassandane/Cyrus/MurderIMAP.pm
+@@ -294,14 +294,18 @@ sub test_move_to_backend_nonexistent
+ 
+     my $frontend = $self->{frontend_store}->get_client();
+     my $backend = $self->{backend1_store}->get_client();
++    my $backend_admin = $self->{backend1_adminstore}->get_client();
+ 
+     # create a destination folder (on both frontend and backend)
+     $frontend->create($dest_folder);
+     $self->assert_str_equals('ok', $frontend->get_last_completion_response());
+ 
+     # nuke the destination folder (on the backend only)
+-    $backend->localdelete($dest_folder);
+-    $self->assert_str_equals('ok', $backend->get_last_completion_response());
++    # n.b. 'INBOX' is part of the mailbox name, it's not just the cassandane
++    # user's inbox, hence the weird admin path here.  Not sure why I did it
++    # that way, might have been just what was in the bug report.
++    $backend_admin->localdelete('user.cassandane.INBOX.dest');
++    $self->assert_str_equals('ok', $backend_admin->get_last_completion_response());
+ 
+     my $f_folders = $frontend->list('', '*');
+     $self->assert_deep_equals(
+diff --git a/imap/imapd.c b/imap/imapd.c
+index 2cb5126..51aecc7 100644
+--- a/imap/imapd.c
++++ b/imap/imapd.c
+@@ -7346,19 +7346,22 @@ static void cmd_delete(char *tag, char *name, int localonly, int force)
+     /* local mailbox */
+     if (!r) {
+         int isadmin = imapd_userisadmin || imapd_userisproxyadmin;
++        int delflags = force ? MBOXLIST_DELETE_FORCE : 0;
+ 
+         if (mbname_isdeleted(mbname)) {
+             r = mboxlist_deletemailbox(mbname_intname(mbname),
+                                        isadmin, imapd_userid,
+                                        imapd_authstate, mboxevent,
+-                                       MBOXLIST_DELETE_LOCALONLY);
++                                       delflags | MBOXLIST_DELETE_LOCALONLY);
+         }
+         else if (!isadmin && mbname_issystem(mbname)) {
+             r = IMAP_PERMISSION_DENIED;
+         }
+         else {
+             delete_user = mboxname_isusermailbox(mbname_intname(mbname), 1);
+-            int delflags = (1-force) ? MBOXLIST_DELETE_CHECKACL : 0;
++
++            if (!force)
++                delflags |= MBOXLIST_DELETE_CHECKACL;
+ 
+             if (!delete_user && mboxlist_haschildren(mbname_intname(mbname))) {
+                 r = IMAP_MAILBOX_HASCHILDREN;
diff -Nru cyrus-imapd-3.10.2/debian/patches/series cyrus-imapd-3.10.2/debian/patches/series
--- cyrus-imapd-3.10.2/debian/patches/series	2026-07-12 21:29:05.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/series	2026-08-02 12:00:00.000000000 +0200
@@ -8,3 +8,12 @@
 0018-increase-test-timeout.patch
 #0019-propagate-XXFLAGS.patch
 eventsource-without-websocket.patch
+0020-lmtp_sieve.c-enforce-ACL-on-vacation-fcc-destination.patch
+0021-imap-message.c-fix-heap-exposure-in-nested-MIME-comm.patch
+0022-imapd-MULTISEARCH-must-check-ACL_READ-on-each-mailbo.patch
+0023-imapd-reject-URLFETCH-when-no-mboxkey-exists-for-the.patch
+0024-imapd-LISTRIGHTS-requires-admin-rights.patch
+0025-imapd-require-read-access-for-XAPPLEPUSHSERVICE-mail.patch
+0026-imapd.c-re-check-URLAUTH-authorizer-access-just-in-t.patch
+0027-imapd-require-read-access-on-mailbox-in-GENURLAUTH.patch
+0028-imapd-fix-cmd_delete-force-handling.patch