CVE-2026-82973

CriticalCVSS 9.4/10Last modified Sep 29, 2026

Description

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-93

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
psyb0t	docker-mailbox	>= 0.1.0, <= 0.4.12

References

https://gitlab.com/psyb0t/docker-mailbox/-/commit/90e6b492d42e011d0ba2c825795b33d054ee6636

Timeline

Published: Sep 29, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-829767.1A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP f CVE-2026-829778.4The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-sub CVE-2026-829784.3An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule s CVE-2026-829806.3Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves f CVE-2026-829824.3The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from app CVE-2026-829833.3The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level pe CVE-2026-829844.3When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member o CVE-2026-829856.5The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewi CVE-2026-829864.6The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though t CVE-2026-829877.5There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated atta CVE-2026-829887.5There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated atta CVE-2026-829899.8There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to injec