CVE-2026-61910

Undergoing Analysis Undergoing Analysis - In Progress

Mailbox Special-Use Role Modification in Cyrus IMAP

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: MITRE

Description

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-61910

EUVD

EUVD-2026-75130

Affected Vendors & Products

Vendor	Product	Version / Range
cyrus	imap	to 3.12.4 (exc)
cyrus	imap	3.12.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Cyrus IMAP before 3.12.4 allows an authenticated user with certain permissions to modify the special-use role of a shared mailbox. This could change the mailbox's purpose, such as marking it as archived or snoozed, potentially causing unintended sharing of additional mail content.

Detection Guidance

Detection requires checking Cyrus IMAP server versions. Run 'cyrus-imapd --version' to verify if your version is below 3.12.4. Inspect mailbox annotations for unauthorized changes to special-use roles using IMAP commands like 'GETANNOTATION'.

Impact Analysis

If exploited, this vulnerability could allow an attacker to alter shared mailbox roles, leading to unintended exposure of sensitive emails. This might result in data leaks or unauthorized access to confidential information stored in the mailbox.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal or health data, violating GDPR or HIPAA requirements. Organizations using vulnerable versions of Cyrus IMAP may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Cyrus IMAP to version 3.12.4 or later immediately. Review shared mailbox permissions to ensure only authorized users can modify special-use annotations. Monitor mailbox roles for unexpected changes.

Hi! I’m here to help you understand CVE-2026-61910. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70