Skip to main content

5.7.7

Version publiée le 05/11/2026​

Changelog published on 5 November 2026​

Security fixes​

This release fixes security vulnerabilities, including critical ones. We recommend installing it as soon as possible.

Note: Scores are calculated using CVSS 3.1.

Acknowledgements
Olivier Lasne, Synacktiv
We would like to thank Synacktiv for its security analysis of BlueMind and for the coordinated disclosure process it carried out with us. Several of the vulnerabilities that have been fixed, including critical ones, were identified in its report.

Upgrades​

  • Netty: 4.2.20
  • Vertx: 5.2.3

BlueMind Applications​

BlueMind Webmail (Mail App)​

  • BM-23619: Fixes: Recipients in blind carbon copy do not receive an email when it is signed.
  • BM-23763: Fixes: An email with no sender displays no-reply@no-reply.com.
  • BM-24267: Fixes: The tooltip for shared mailboxes displays "Storage space full" instead of "Storage space almost full" when the quota exceeds 90 per cent.
  • BM-24380: Fixes: Interface slowdown when selecting a very large number of emails.
  • BM-24441: Fixes: Text sections in the format format=flowed are displayed without being decoded.
  • BM-24443: Fixes: The AI panel on mobile devices loses the editor selection when clicking "Other" and displays the message "No messages selected".
  • BM-24459: Fix: Attachments opened from the preview pane can no longer execute scripts.
  • BM-24464: Fixes: The styles of a quoted email are reinterpreted and overflow their style element.
  • BM-24475: Fix: A link mailto: can no longer insert active HTML code from within the composer.
  • BM-24481: Fixes: Identity signatures are displayed in the identity block without being cleaned first.
  • BM-24540: Fixes: When replying, selecting text in the editor causes the highlight to flicker.

Webmail Preferences​

  • BM-23170: Fixes: The preview for the "Group by conversation" setting no longer displays sample images when performing a search.

Calendar​

  • BM-24572: Fixes: Returning to the root of an application no longer retains its last view; it reopens to a view that had previously been closed.
  • Fix: Synchronisation of ICS calendars to which the user is subscribed now shares a client and reuses its connections.
  • Fix: The “Manage shares” sharing right is now required to publish a calendar with a private URL and then download it, or to list and disable its publication URLs.
  • Fix: Read access to a calendar is now required to view events with a pending counter-proposal.
  • Fix: The ‘free/busy’ status via email now uses the permissions of the authenticated caller and is denied without a session.
  • Fix: Event attachments can now only be downloaded from a whitelisted host or from an external BlueMind URL.

Web applications (Webmail, Electron client, administration console)​

  • BM-24463: Fixes: Links using custom protocols (javascript: or other) are accepted in invitation URLs (video conferencing, URL field). These are no longer displayed in emails or the calendar.
  • BM-24531: Fixes: The sudo command in the administration console, the imports (ICS, vCard, tasks) and file uploads (certificates, photos) fail after 10 seconds (as soon as the session is no longer in the webserver’s cache).

Contacts​

  • BM-24224: Fixes: A message stating "This label is already in use" appears after creating a new address book.
  • BM-24411: Fixes: The vCard import (e.g. Google Takeout export) does not recognise properties with a group prefix (e.g. item1.ADR); the affected field is then lost and the preceding field is corrupted.
  • BM-24131: Fixes: Error when creating a contact with an invalid certificate.
  • BM-24492: Fixes: Adding an existing tag to multiple emails or contacts displays a ‘tag added’ notification.
  • BM-23940: Fixes: Editing certain fields does not enable the "Save" button.
  • BM-23923: Fixes: When creating a contact with a birthday or anniversary date, these dates are offset by one day.
  • Fixes: The Contacts app may be overlaid by a contact’s note or a fake login form.

CardDAV​

  • BM-24546: Fixes: A large CardDAV synchronisation (large address book) blocks other DAV connections.

MAPI / Outlook​

  • BM-24536: Fixes: A meeting accepted via Outlook may disappear from the server’s calendar after ten minutes without any changes.
  • BM-24497: Fixes: Unable to confirm resource bookings from Outlook.
  • Fix: The list of FAI access rights for public folders is no longer rewritten on every Outlook connection.
  • Fix: The MAPI APIs (replica, Outlook ISP) are now internal and are no longer accessible via /api.
  • Fixes: A MAPI property of type stream:///… allowed bm-mapi to read an arbitrary file from the server. Only files in the MAPI spool directory are now read.

Mobile Devices (EAS)​

  • BM-24522: Fixes: A cancelled instance of a recurring meeting is displayed as accepted on iPhone; accepting it fails silently.
  • BM-24547: Fixes: Sending an email or opening an attachment from an older phone (ActiveSync < 14) blocks other ActiveSync connections.

Thunderbird​

  • BM-24245: Fixes: Quotas for all mailboxes are not loaded when opening Preferences or from the Quotas window.
  • Fixes: The Thunderbird autoconfiguration server now only serves the .xpi XML files from its extensions directory; other files return a 404 error.

Video Conferencing​

  • Fixes: A session is now required to access a BlueMind video conference room; guests can still join the room using their token.

Administration / Architecture​

Administration console​

  • BM-18009: Fix: Suspending a user by a domain administrator now terminates their sessions.
  • BM-24389: Fixes: The sharing tab was mixing shares from different containers when switching containers.
  • BM-24538: Fixes: An upgrade of a user outside the administration console removes their AI functionality.

Directory, users and resources​

  • Fix: The user API no longer returns password hashes (including admin0) to a domain administrator, nor when searching by external username.
  • Fix: A session is now required to read a user’s language property.
  • Fix: Read access to the domain directory is now required to access directory information (names, email addresses, telephone numbers, addresses). Photos and icons remain accessible without authentication.
  • Fix: Read access to the domain directory is now required to view the list of directory changes.
  • Fix: Read access to the domain directory is now required to view the list of sub-units within an organisational unit.
  • Fix: The “Check and Repair” role is now required to view the list of repair operations for an entry and to carry out the repair. Furthermore, configuring administrator roles for an organisational unit requires a session, and no information is saved or reported when roles remain unchanged.
  • Fix: Read access to domain resources is now required to retrieve a resource’s event description template.
  • Fix: UIDs containing a path separator (../) are now rejected upon creation.

Clone​

  • BM-24539: Fixes: A clone was not inheriting features from the source users, such as AI.

Containers​

  • Fixes: Creating a container hierarchy node by username fails with an "already exists" error.
  • Fix: An authorised session is now required to create containers; a non-administrator user can only create a container of which they are the owner.
  • Fix: An authorised session is now required to reserve item id.
  • Fix: Container UIDs containing a path separator (../) are now rejected upon creation.
  • Fix: Write permission is now required to modify a user’s container hierarchy.

Core​

  • BM-24334: Fixes: A memory allocation would wait up to 30 seconds for a memory segment whilst its creation was failing (ENOSPC).
  • Fixes: Resurrection of changesets.
  • Fixes: When a data stream could not be written to a file (disk full, file cannot be opened, etc.), the operation would either succeed with a truncated file or never complete ( bm-cli exports, attachments, WebDAV uploads).
  • Fixes: A full disk would leave empty temporary files in the temporary directory.
  • Fixes: Following a concurrently performed hot upgrade, a background task would run every second until the system was restarted.
  • Fixes: A job that was cancelled and then restarted a few seconds later would remain "in progress" indefinitely.
  • Fixes: The feature for repairing missing email bodies would mark a body as repaired even if it had failed to send.
  • Fixes: An S3 download that failed whilst writing to disk would cause the caller to hang indefinitely.

Email filtering (Milter)​

  • Fixes: Milter now asks the mail server to retry when the temporary storage runs out of space, rather than letting the email pass through without a body.

Mail flows and mail tips​

  • Fix: The domain administrator role is now required to view mail flow rules.
  • Fix: Mail tips are now restricted to domain users and global administrators; they can no longer be viewed without authentication.

File hosting​

  • BM-24577: Fixes:
    • Sharing a file again creates a new public link each time. When the same user shares the same file, the existing link is now reused.
    • Removing a file from an email breaks the link to it in other emails where it has been shared.
  • Fix: Backup, file hosting and task queue files can no longer be saved outside their respective directories using an encrypted ../.

Audit log​

  • Fix: Session usernames are replaced by a SHA-256 hash in the log, and session filtering now works with either the username or its hash (bm-cli auditlog login --session-id).
  • Fix: The audit log query API is now internal: it is no longer served via /api/logs on the public URL.
  • Fix: The system administrator role is now required to access audit logs and manage their storage.

Email delivery (LMTP)​

  • Fixes: Emails deleted by a filter rule cause "Chunk was reclaimed by GC” warnings and a memory leak.
  • Fixes: An email could be delivered truncated with the message 250 Ok when there was insufficient space in the temporary storage, both on receipt and when composing. Delivery now fails with a temporary error (452).
  • Fixes: An error NullPointerException was logged at the ERROR level for every email deleted by a filter rule.
  • Fixes: An email deleted by a domain filter rule was still being delivered to the inbox.
  • Fixes: LMTP error responses included the text of the internal error. They now display internal error, see the server logs.

Mail (IMAP)​

  • Fixes: The IMAP client in bm-cli would keep the connection open after a read error and then treat the email data as replies.
  • Fixes: A major APPEND IMAP would cause other IMAP connections to freeze when storage space ran out. The server now returns - BYE [UNAVAILABLE] in the event of a failure.
  • Fixes: A failed IMAP command (search, folder command) would not receive a response and the client would wait until it timed out. It now receives NO [SERVERBUG].
  • Fixes: IDLE now returns a single response instead of failing to complete in the event of a start-up or shutdown failure on the server side.
  • Fixes: A IDLE process that was terminated immediately after starting could remain subscribed to changes in the mailbox.
  • Fixes: COPY and APPEND pointing to a non-existent folder now return NO [TRYCREATE] (RFC 3501), to allow the client to create the folder.
  • Fixes: The internal IMAP client would crash silently when it was unable to read a response from the server.
  • Fixes: IMAP error responses now use fixed text instead of the internal error text or that sent by the client; details are logged.
  • Fixes: Permission on a mailbox is now required to view the full name of one of its folders.

Notes, tasks and S/MIME​

  • Fix: Read or write permissions on the notes container are now required to view or edit them, and access to a container that is not a note is denied.
  • Fix: Read access to the task container is now required to view tasks, and a container that is not a task list is rejected.
  • Fix: The S/MIME Certificate Authority API no longer exposes other containers without authentication. Furthermore, reading a certificate by its username requires read access to the S/MIME container, and the API rejects any container that is not an S/MIME CA certificate container.
  • Fix: Importing an ICS file is rejected before the task is launched if the caller does not have write access to the task list.

Backup and Restore (DataProtect)​

  • Fix: Backup, file hosting and task queue files can no longer be saved outside their respective directories using an encrypted ../.

System and installation​

  • Fix: Authentication is now required for access:
    • to installation notifications (trial or subscription expiry, health report alerts)
    • to custom properties and the roles catalogue (showing installed plugins and subscription status)
    • to the external systems API, including connection testing
    • to the domain template, the upgrade status and the Let's Encrypt terms of use. Furthermore, the certificate management role is required to meet Let's Encrypt’s requirements.
    • to task status, results and logs
  • Fix: Global settings now require the System Administration or System Configuration role.
  • Fix: Only /etc/bm/bm.ini can now be read or written to by the installation wizard.

Monitoring​

  • Fixes: The Java OpenTelemetry agent failed to start due to a resource schema conflict when a service name was configured.