Skip to main content

5.5.20

Version publiée le 05/11/2026​

Changelog published on 6 November 2026​

Security fixes​

This release fixes security vulnerabilities, including critical ones. We recommend installing it as soon as possible.

Note: Scores are calculated using CVSS 3.1.

Acknowledgements
Olivier Lasne, Synacktiv
We would like to thank Synacktiv for its security analysis of BlueMind and for the coordinated disclosure process it carried out with us. Several of the vulnerabilities that have been fixed, including critical ones, were identified in its report.

Vulnerability fixes​

  • BM-24458: [High] The access denied page no longer displays the login in plain text.

Upgrades​

  • Netty: 4.2.20
  • Vertx: 5.2.3

BlueMind Applications​

BlueMind Webmail (Mail App)​

  • BM-24459: Fix: Attachments opened from the preview pane can no longer execute scripts.
  • BM-24464: Fixes: The styles of a quoted email are reinterpreted and overflow their style element.
  • BM-24475: Fix: A link mailto: can no longer insert active HTML code from within the composer.
  • BM-24481: Fixes: Identity signatures are displayed in the identity block without being cleaned first.

Calendar​

  • Fix: The “Manage shares” sharing right is now required to publish a calendar with a private URL and then download it, or to list and disable its publication URLs.
  • Fix: Read access to a calendar is now required to view events with a pending counter-proposal.
  • Fix: The ‘free/busy’ status via email now uses the permissions of the authenticated caller and is denied without a session.
  • Fix: Event attachments can now only be downloaded from a whitelisted host or from an external BlueMind URL.

Web applications (Webmail, Electron client, administration console)​

  • BM-24463: Fixes: Links using custom protocols (javascript: or other) are accepted in invitation URLs (video conferencing, URL field). These are no longer displayed in emails or the calendar.

MAPI / Outlook​

  • Fix: The list of FAI access rights for public folders is no longer rewritten on every Outlook connection.
  • Fix: The MAPI APIs (replica, Outlook ISP) are now internal and are no longer accessible via /api.
  • Fixes: A MAPI property of type stream:///… allowed bm-mapi to read an arbitrary file from the server. Only files in the MAPI spool directory are now read.

Thunderbird​

  • Fixes: The Thunderbird autoconfiguration server now only serves the .xpi XML files from its extensions directory; other files return a 404 error.

Video Conferencing​

  • Fixes: A session is now required to access a BlueMind video conference room; guests can still join the room using their token.

Administration / Architecture​

Authentication​

  • BM-18009: Fixes: Suspending a user did not close their sessions, particularly when carried out by a domain administrator.
  • BM-24010: Fixes: The SMTP authentication cache was using an incorrect key, meaning that a user who had been deactivated or whose password had changed would continue to authenticate until the cache was completely cleared.
  • BM-24010: Fixes: A suspended user could still authenticate via SMTP/IMAP using a directory password, an API key or a cached session token. These usernames are now rejected.

Directory, users and resources​

  • Fix: The user API no longer returns password hashes (including admin0) to a domain administrator, nor when searching by external username.
  • Fix: A session is now required to read a user’s language property.
  • Fix: Read access to the domain directory is now required to access directory information (names, email addresses, telephone numbers, addresses). Photos and icons remain accessible without authentication.
  • Fix: Read access to the domain directory is now required to view the list of directory changes.
  • Fix: Read access to the domain directory is now required to view the list of sub-units within an organisational unit.
  • Fix: Only a user with the "check&repair" role can initiate the repair of a directory entry within the domain of that entry. Domain administrators and the relevant unit can still initiate the repair.
  • Fix: Read access to domain resources is now required to retrieve a resource’s event description template.
  • Fix: UIDs containing a path separator (../) are now rejected upon creation.

Audit log​

  • Fix: The audit log query API is now internal: it is no longer served via /api/logs on the public URL.
  • Fix: The system administrator role is now required to access audit logs and manage their storage.

Containers​

  • Fixes: Creating a container hierarchy node by username fails with an "already exists" error.
  • Fix: An authorised session is now required to create containers; a non-administrator user can only create a container of which they are the owner.
  • Fixes: Usernames could be reserved in bulk without authentication, which exhausted the sequence. A session is required.
  • Fix: An authorised session is now required to reserve item id.
  • Fix: Container UIDs containing a path separator (../) are now rejected upon creation.
  • Fix: Write permission is now required to modify a user’s container hierarchy.

Notes, tasks and S/MIME​

  • Fix: Read or write permissions on the notes container are now required to view or edit them, and access to a container that is not a note is denied.
  • Fix: Read access to the task container is now required to view tasks, and a container that is not a task list is rejected.
  • Fix: The S/MIME Certificate Authority API no longer exposes other containers without authentication. Furthermore, reading a certificate by its username requires read access to the S/MIME container, and the API rejects any container that is not an S/MIME CA certificate container.
  • Fix: Importing an ICS file is rejected before the task is launched if the caller does not have write access to the task list.

File hosting​

  • Fix: Backup, file hosting and task queue files can no longer be saved outside their respective directories using an encrypted ../.

Mail (IMAP)​

  • Fixes: The full name of a mail folder (e.g. INBOX/Legal/Divorce) was viewable without authentication. View permission for the mailbox is required.

Mail flows and mail tips​

  • Fix: The domain administrator role is now required to view mail flow rules.
  • Fix: Mail tips are now restricted to domain users and global administrators; they can no longer be viewed without authentication.

Backup and Restore (DataProtect)​

  • Fix: Backup, file hosting and task queue files can no longer be saved outside their respective directories using an encrypted ../.

System and installation​

  • Fix: Authentication is now required for access:
    • to installation notifications (trial or subscription expiry, health report alerts)
    • to custom properties and the roles catalogue (showing installed plugins and subscription status)
    • to the external systems API, including connection testing
    • to the domain template, the upgrade status and the Let's Encrypt terms of use. Furthermore, the certificate management role is required to meet Let's Encrypt’s requirements.
    • to task status, results and logs
  • Fix: Global settings now require the System Administration or System Configuration role.
  • Fix: Only /etc/bm/bm.ini can now be read or written to by the installation wizard.