CVE-2026-61911

Undergoing Analysis Undergoing Analysis - In Progress

Sieve Mailbox Existence Oracle in Cyrus IMAP

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: MITRE

Description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-61911

EUVD

EUVD-2026-75129

Affected Vendors & Products

Vendor	Product	Version / Range
cyrus	imap	to 3.12.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

This vulnerability in Cyrus IMAP before 3.12.4 allows an authenticated user to create a Sieve script that acts as a mailbox existence oracle. During LMTP delivery, the script can determine if another user's private mailbox exists or read shared mailbox annotations by observing which fileinto branch is executed.

Detection Guidance

This vulnerability involves an authenticated user exploiting Sieve scripts to probe mailbox existence or read shared mailbox annotations. Detection requires monitoring Sieve script installations and LMTP delivery logs for unusual fileinto branch activations or script behaviors that indicate probing attempts.

Impact Analysis

An attacker could exploit this to probe for the existence of private mailboxes of other users, potentially revealing sensitive information about email account structures or shared resources. This could lead to privacy breaches or targeted phishing attacks.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by enabling unauthorized access to information about mailbox existence, which could expose personal or health-related data. Organizations using affected Cyrus IMAP versions may face compliance risks.

Mitigation Strategies

Upgrade Cyrus IMAP to version 3.12.4 or later to address the Sieve mailbox existence oracle vulnerability.

Hi! I’m here to help you understand CVE-2026-61911. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70