Skip to content

mail-archiver

v2607.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 11d Communication & Email
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

archive archiver backup docker imap mail
+1 more
migration

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 11d

The release introduces a new read‑only REST API at /api/v1 and fixes several UI glitches, while critically addressing a cross‑account bypass vulnerability in the email handling components.

Why it matters: Severity 90 security fix eliminates cross‑account bypass for users lacking mailbox grants; developers should review EmailsController/EmailCoreService integration immediately.

Summary

AI summary

Updates 🐛 Bug Fixes, ⚙️ Improvements, and ✨ New Features across a mixed release.

Changes in this release

Security Critical

Closes cross-account bypass for users with no mailbox grants in EmailsController and EmailCoreService

Closes cross-account bypass for users with no mailbox grants in EmailsController and EmailCoreService

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Adds optional read-only REST API (v1) under /api/v1

Adds optional read-only REST API (v1) under /api/v1

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Adds spinner and disables search submit button during request

Adds spinner and disables search submit button during request

Source: llm_adapter@2026-07-15

Confidence: low

 —
Feature Low

Shows spinner and disables search submit button while search is in flight

Shows spinner and disables search submit button while search is in flight

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Bugfix High

Eliminates dark mode flash by applying theme synchronously via blocking inline script

Eliminates dark mode flash by applying theme synchronously via blocking inline script

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Populates RawHeaders for M365/Graph-synced mail via internetMessageHeaders

Populates RawHeaders for M365/Graph-synced mail via internetMessageHeaders

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Adapts dashboard chart colors to active theme and updates live on dark mode toggle

Adapts dashboard chart colors to active theme and updates live on dark mode toggle

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes dashboard recent-emails timestamps and single-EML export Date header to use stored display timezone consistently

Fixes dashboard recent-emails timestamps and single-EML export Date header to use stored display timezone consistently

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Renames dashboard storage tile label to "Database size"

Renames dashboard storage tile label to "Database size"

Source: llm_adapter@2026-07-15

Confidence: low

 —
Full changelog

✨ New Features

  • Read-only REST API (v1) - Optional, off-by-default REST API under /api/v1 for programmatic access to the archive (reporting, e-discovery, monitoring, AI agents) without exposing mailbox credentials or talking to the mail provider. See documentation here. Thanks to @kipp-ing for the PR!

⚙️ Improvements

  • Search Loading Indicator - Search submit button shows a spinner and is disabled while the search request is in flight
  • Dashboard Storage Label - Renamed the dashboard storage tile label to "Database size" to clarify it shows the database size, not mailbox storage

🐛 Bug Fixes

  • Dark Mode Flash on Page Navigation - Theme is now applied synchronously via a blocking inline script in the <head> before stylesheets load, eliminating the brief light-mode flash during page transitions
  • Zero-Grant Access Control - Closed cross-account bypass for users with no mailbox grants in EmailsController and EmailCoreService - M365 Graph Raw Headers - Populate RawHeaders for M365/Graph-synced mail via internetMessageHeaders,
  • Dashboard Chart Dark Mode - Charts (monthly bar + top senders doughnut) now adapt text, grid, legend and tooltip colors to the active theme and update live when toggling dark mode
  • Dashboard & Export Timezone - Fixed recent-emails timestamps on the dashboard being shifted by the configured display timezone offset (shown as UTC by the JS converter) and single-EML export emitting a wrong Date: header; both now use the stored display-timezone value consistently with the emails index/details pages

Security Fixes

  • Zero‑grant access control bypass closed in EmailsController and EmailCoreService
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track mail-archiver

Get notified when new releases ship.

Sign up free

About mail-archiver

Mail-Archiver is a web application for archiving, searching, and exporting emails from multiple accounts. Featuring folder sync, attachment support, mailbox migration and a dashboard.

All releases →

Related context

Related tools

Earlier breaking changes

  • v2606.1 Migrates all existing attachments, temporarily increasing storage requirements; backup required before upgrade

Beta — feedback welcome: [email protected]