CVE-2026-61910
Description
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)
How to fix
- cyrus imap3.8.8, 3.10.4, 3.12.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cyrus imap | v < 3.8.8, 3.9.0 ≤ v < 3.10.4, 3.11.0 ≤ v < 3.12.4 | 3.8.8, 3.10.4, 3.12.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.