CVE-2026-61910: Low severity Cyrus IMAP Cyrus IMAP vulnerability
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cyrus IMAPto a version that resolves this vulnerability.Fixed in 3.12.4 - Compensating control
Restrict the 'maySetKeywords' right (or the ability to use Mailbox/set) so authenticated users cannot modify another user's mailbox special-use annotations.
Event History
Frequently Asked Questions
Who is exposed to this issue?
The affected scenario requires an authenticated sharee who has the maySetKeywords permission on another user's mailbox. Exposure is unusual because the mailbox must be shared with that permission granted.
What conditions make exploitation effective?
The sharee must be able to change the shared mailbox's special-use annotation and assign a role such as archived or snoozed. If the target already has a non-shared mailbox assigned to that role, role-duplication suppression prevents the update.
What is the potential impact?
A successful change can cause mail associated with the selected special-use role to be written to the shared mailbox. This may expose more message content to the sharee than the mailbox owner intended.
What can be done before upgrading?
Review shared-mailbox permissions and remove maySetKeywords from users who do not require it. Also review special-use role assignments on shared mailboxes, particularly archived and snoozed roles.