Cyrus IMAP

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Any qualifying bug: one discretionary band, set by severity and by how many users are affected │ $100 - $5,000 │ $125 - $6,000 Submit a vulnerability CVE history 9 Last 12 months 18 Lifetime Memory safety 35 % Access control 30 % Auth bypass 20 % Denial of service 10 % Latest advisories Loading the feed Overview Cyrus IMAP is the mail store behind Fastmail itself and, historically, the default enterprise IMAP server in large university, government and ISP deployments, where it was chosen for its ability to hold very large mailbox counts on shared storage. It is far less visible than Dovecot in the self-hosted world but disproportionately present in institutional infrastructure, and Fastmail's own multi-million-mailbox service running on it means a Cyrus defect has a concentrated, high-value blast radius rather than a wide, shallow one. The codebase is not dormant: nine of its eighteen lifetime CVEs landed in 2026 alone, a contiguous block from CVE-2026-47081 to CVE-2026-47089. Fastmail is the principal corporate developer of Cyrus and pays for Cyrus bugs on its own self-run programme — the written scope asks you to "find a bug that could allow access to private user data, or enable access to a system running Fastmail infrastructure", and the 2026 hall of fame records $3,750 paid for "Missing calendar ACL checks and Cyrus memory mismanagement", which is exactly this. Any qualifying bug pays a minimum of $100 and a maximum of $5,000, set by severity and by how many users are affected; the published table sits mostly at $100 to $500 with a handful of $2,000 to $4,000 outliers, so the ceiling is real but rarely reached. sorona.xyz adds 1.25× on top of whatever Fastmail awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times reports read within 24 hours First response up to 10 business days Triage paid monthly Bounty In scope Fastmail's written scope is service-framed and does not name the repository: qualify by finding a bug that could allow access to private user data, or enable access to a system running Fastmail infrastructure. Cyrus is the software running that infrastructure, and the 2026 hall of fame records $3,750 paid for a Cyrus finding. That puts the Cyrus server in scope as a whole rather than one component of it, on any path a researcher can drive against the production service with a test account imapd and the IMAP command and protocol parsing it performs, before authentication completes as much as after The authentication path: SASL mechanisms, session establishment and the credential handling around them httpd and the JMAP, CalDAV and CardDAV implementations riding on it, including the ACL model deciding who may read a calendar or an address book Delivery through lmtpd and the Sieve engine, plus the MIME and charset decoding that turns an attacker-supplied message into index entries The storage layer: mailbox, index, cache and annotation handling, and the cyrusdb backends underneath them Replication and the Murder aggregator, sync_client , sync_server and mupdate , which move mailbox state between servers Out of scope Email spoofing, excluded explicitly and at length: "We are quite aware that users can set arbitrary From addresses on emails... These policy decisions are by design." Denial of service, excluded and prohibited: "Denial of Service (DOS) and social engineering attacks do not qualify and must not be attempted." Cross-site scripting on user.fm and fastmailusercontent.com, which are deliberate untrusted-content domains Username enumeration Version-disclosure findings: "We are not interested in reports about 'leakage' of the fact we run nginx, or the version number, or Perl module names or file paths." CSV and Excel macro injection via address-book export A defect visible in the Cyrus tree that you cannot demonstrate against Fastmail's production service, since the scope sentence is written around that service rather than around the repository Duplicates: only the first reporter of an issue is paid Most-valued findings Memory corruption in the Cyrus daemon reachable from an IMAP session before authentication completes. Memory safety is 35% of the expected distribution here, and pre-auth reachability is what moves a report toward the $5,000 end of a discretionary band. ACL enforcement gaps in the CalDAV and CardDAV code that let one account read or modify another's calendar or contacts; this is the one class Fastmail has demonstrably paid four figures for in the current year Authentication bypass that lets a session act as an account it never proved ownership of, 20% of the distribution and the shortest path to "access to private user data" as the scope sentence phrases it Cross-account data exposure through index, mailbox or annotation handling, where the bug is an accounting error in shared storage rather than a missing check Anything that scales across mailboxes rather than affecting one: the award is set partly by how many users are affected, and Fastmail's install is measured in millions of them Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The scope sentence is service-framed, not repository-framed: show the Cyrus defect reaching private user data or a system running Fastmail infrastructure, using a test account against the production service, rather than only pointing at the code You must be the first reporter of the issue: duplicates are not paid Denial of service and social engineering do not qualify and, in Fastmail's own words, "must not be attempted" Give Fastmail reasonable time to fix before you make anything public; in return they undertake to investigate promptly and not to take legal action against you Awards are paid monthly, via PayPal Disclosure Coordinated directly with Fastmail's senior staff at [email protected] : there is no platform in between. The published bargain is explicit: reasonable time to fix in exchange for prompt investigation and no legal action, and accepted findings are credited by name on the public hall of fame. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability