CVE-2021-37845: An issue was discovered in Citadel through webcit-932.

Security readout for executives and security teams

This is a low-severity Citadel/WebCit mail issue involving STARTTLS session handling. A network meddler between a user and the server may influence a session before encryption begins, potentially causing a victim's email to land in an attacker-controlled IMAP mailbox. Impact depends on specific client behavior, so exposure is real but conditional. Likely limited to organizations running Citadel/WebCit mail services through webcit-932, especially where IMAP STARTTLS is reachable over networks an attacker could intercept. The structured affected-product data in the bundle is incomplete, so exact product/version scoping needs vendor confirmation. Handle through normal vulnerability management unless Citadel/WebCit supports sensitive mail or is exposed on hostile networks. The business risk is confidentiality loss through misdelivered mail, but the available evidence shows low severity, high attack complexity, and no confirmed exploitation. Mitigation focus: Inventory Citadel/WebCit mail services and identify any builds through webcit-932.; Review Citadel security guidance for the fixed version or supported workaround.; Apply vendor-provided updates or configuration changes once confirmed..

Prepared

Jun 1, 2026, 14:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.