Mailu 2024.06.49 → 2024.06.56
7 releases · 0 breaking changes · 3 security fixes · 1 advisory fixed
3security0breaking0deprecated0feature2fix
Vulnerabilities fixed by this upgrade
- 9.8 CVE-2026-85751 Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Breaking changes
None in the release notes.
Security changes
- security roundcube 1.6.17 - fix multiple CVEs: CVE-2026-54432 CVE-2026-54433 in 2024.06.56
- security Ensure we set X-Forwarded-By, see GHSA-rfhj-4wcq-74xg in 2024.06.55
- security Fix CVE-2026-49217 in 2024.06.52
Every release in between
securityroundcube 1.6.17 - fix multiple CVEs: CVE-2026-54432 CVE-2026-54433
otherThis release was triggered by PR/Issue 4073.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
securityEnsure we set X-Forwarded-By, see GHSA-rfhj-4wcq-74xg
otherThis release was triggered by PR/Issue 4070.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix two admin-UI form-flow bugs: the forced password change now redirects to the chosen destination instead of always the admin UI, and the Create User form keeps the entered values and validation errors on a failed submit.
otherThis release was triggered by PR/Issue 4060.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
fixFix automatic replies (vacation) failing to compile when the account display name contains special characters such as @; the sieve :from now uses a quoted RFC 5322 display name, and all user-controlled fields rendered into the script are escaped (\, ", $) to prevent sieve injection.
otherThis release was triggered by PR/Issue 3983.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherUpgrade roundcube to 1.6.16 and carddav to 5.1.3
securityFix CVE-2026-49217
otherThis release was triggered by PR/Issue 4030.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherUpgrade alpine to 3.20.10
otherThis release was triggered by PR/Issue 4018.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.
otherUpdate roundcube to 1.6.15
otherThis release was triggered by PR/Issue 4015.
otherThe release notes of the original main release can be accessed via menu item 'Release notes' on mailu.io.