CVE-2026-61910
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In Cyrus IMAP before 3.12.4, Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail to be written to the shared mailbox, sharing more content than intended.
Risk Assessment
The vulnerability may lead to unauthorized changes in shared mailbox configuration, potentially resulting in uncontrolled content sharing or disruption of mailbox functionality.
Recommendation
It is recommended to upgrade Cyrus IMAP to version 3.12.4 or later, which includes a fix for this issue.
Other vulnerabilities in Cyrus IMAP
See all- CVE-2015-8077High
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable.
- CVE-2015-8076High
The index_urlfetch function in Cyrus IMAP versions 2.3.x before 2.3.19, 2.4.x before 2.4.18, and 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
- CVE-2017-14230Critical
In the mboxlist_do_find function in Cyrus IMAP before version 3.0.4, an off-by-one error in prefix calculation for the LIST command led to the use of uninitialized memory. This may allow remote attackers to obtain sensitive information or cause a daemon crash.
- CVE-2026-61915Medium
In Cyrus IMAP before 3.12.4, there is a double-free vulnerability in the VPATCH BYPARAM mechanism. An authenticated calendar user can crash a CalDAV worker by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector is freed multiple times during iteration over properties.
- CVE-2026-61911Medium
In Cyrus IMAP before 3.12.4, there is a Sieve mailbox existence oracle. An authenticated user can install a Sieve script that probes whether another user's private mailbox exists, or reads the value of shared mailbox annotations, by observing which fileinto branch fires during LMTP delivery.
- CVE-2026-61909Low
In Cyrus IMAP before 3.12.4, CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.
- CVE-2026-61908Low
In Cyrus IMAP before 3.12.4, a JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
- CVE-2026-61907Medium
In Cyrus IMAP before 3.12.4, JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
- CVE-2026-47089Medium
In cyrus-imapd up to version 3.12.2, the LISTRIGHTS command was not restricted to users with admin access. An authenticated user could call LISTRIGHTS against any mailbox they could name and learn what principals had what access to it.
- CVE-2026-47088Low
In cyrus-imapd up to version 3.12.2, a vulnerability was discovered involving heap exposure during parsing of nested MIME comments. An authenticated IMAP user can craft an email message containing an RFC 822 comment ending with a backslash, causing the server to read past the message's end in memory and return heap content.
Original NVD description (English source)
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)