CVE-2026-61911

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cyrusimap.org	Product
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html	Release Notes
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html	Release Notes
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cyrus:imap::::::::
	cpe:2.3:a:cyrus:imap::::::::
	cpe:2.3:a:cyrus:imap::::::::

History

16 Sep 2026, 15:23

Type	Values Removed	Values Added
First Time		Cyrus Cyrus imap
CPE		cpe:2.3:a:cyrus:imap::::::::
References	~~() https://cyrusimap.org -~~	() https://cyrusimap.org - Product
References	~~() https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html -~~	() https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html - Release Notes
References	~~() https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html -~~	() https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html - Release Notes
References	~~() https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html -~~	() https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html - Release Notes

Information

Published : 2026-09-09 20:18

Updated : 2026-09-16 15:23

NVD link : CVE-2026-61911

Mitre link : CVE-2026-61911

CVE.ORG link : CVE-2026-61911

JSON object : View

Products Affected

cyrus

imap

CWE

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2026-61911", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61911", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T18:59:21.694757Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "cyrusimap", "product": "Cyrus IMAP", "versions": [{"status": "affected", "version": "0", "lessThan": "3.8.8", "versionType": "semver"}, {"status": "affected", "version": "3.9.0", "lessThan": "3.10.4", "versionType": "semver"}, {"status": "affected", "version": "3.11.0", "lessThan": "3.12.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-09T20:18:36.800", "references": [{"url": "https://cyrusimap.org", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery."}], "lastModified": "2026-09-16T15:23:58.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28C57505-AC73-4870-AF38-C27602313743", "versionEndExcluding": "3.8.8"}, {"criteria": "cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B34CFCEF-7C23-40E2-8B1C-99574EAEFA83", "versionEndExcluding": "3.10.4", "versionStartIncluding": "3.9.0"}, {"criteria": "cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F48F621D-9615-43D9-9086-7A506473291B", "versionEndExcluding": "3.12.4", "versionStartIncluding": "3.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}