CVE-2026-61907
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox...
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
- Record
CVE-2026-61907- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-75139
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
- Record
EUVD-2026-75139- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-245j-3rxm-cqmg
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox...
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
- Record
GHSA-245j-3rxm-cqmg- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
- Record
CVE-2026-61907- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-61907
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
- Record
DEBIAN-CVE-2026-61907- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-61907
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
- Record
UBUNTU-CVE-2026-61907- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21929-1 No score
Security update for cyrus-imapd
This update for cyrus-imapd fixes the following issues:
Changes in cyrus-imapd:
Update to 3.8.8 (bugfix release):
- CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL (bsc#1279908)
- CVE-2026-61908: JMAP email-header blob ID out-of-bounds index (bsc#1279975)
- CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL (bsc#1279976)
- CVE-2026-61910: Mailbox/set let sharee change special-use role on shared mailboxes (bsc#1279977)
- CVE-2026-61911: Sieve mailbox existence oracle (bsc#1279978)
- CVE-2026-61915: VPATCH BYPARAM double-free (bsc#1279979)
- Record
openSUSE-SU-2026:21929-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cyrus-imapdDebian:12 |
All versions, plus listed versions 3.10.0-13.10.0~beta1-13.10.0~beta1-23.10.0~beta1-33.10.0~beta2-1 Show 40 moreShow less3.10.0~rc2-13.10.1-13.10.1-23.10.1-33.10.1-3~bpo12+13.10.2-13.10.2-1~bpo12+13.12.0-13.12.0-23.12.1-13.12.1-23.12.1-33.12.2-13.12.3-13.12.3-1~bpo13+13.12.3-23.12.3-33.12.3-43.12.4-13.6.1-43.6.1-4+deb12u13.6.1-4+deb12u23.6.1-4+deb12u33.6.1-4+deb12u43.6.1-4+deb12u53.8.0-13.8.0-23.8.0-33.8.0-43.8.0-53.8.0~beta1-13.8.0~beta2-13.8.0~rc1-13.8.1-13.8.1-1~bpo12+13.8.1-23.8.1-33.8.2-13.8.3-13.8.4-1 |
None known |
cyrus-imapdDebian:13 |
All versions, plus listed versions 3.10.2-13.10.2-1+deb13u13.10.2-1+deb13u23.12.0-13.12.0-2 Show 10 moreShow less3.12.1-13.12.1-23.12.1-33.12.2-13.12.3-13.12.3-1~bpo13+13.12.3-23.12.3-33.12.3-43.12.4-1 |
None known |
cyrus-imapdDebian:14 |
before 3.12.4-1, plus listed versions 3.10.2-13.12.0-13.12.0-23.12.1-13.12.1-2 Show 7 moreShow less3.12.1-33.12.2-13.12.3-13.12.3-1~bpo13+13.12.3-23.12.3-33.12.3-4 |
3.12.4-1 |
cyrus-imapdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.10-3build12.5.10-3build22.5.10-3ubuntu12.5.10-3ubuntu1.12.5.10-3ubuntu1.1+esm1 |
None known |
cyrus-imapdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.11-13.0.11-1build13.0.12-13.0.12-23.0.12-2ubuntu2 Show 7 moreShow less3.0.12-2ubuntu33.0.13-2ubuntu13.0.13-3ubuntu13.0.13-4ubuntu13.0.13-53.0.13-5ubuntu0.1~esm13.0.13-5ubuntu0.1~esm2 |
None known |
cyrus-imapdUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.2.6-2build13.4.2-23.4.2-2build13.4.3-23.4.3-3 Show 5 moreShow less3.4.3-3build23.4.3-3ubuntu0.13.4.3-3ubuntu0.1+esm13.4.3-3ubuntu0.33.4.3-3ubuntu0.3+esm1 |
None known |
cyrus-imapdUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.8.0-53.8.1-13.8.1-1build13.8.1-1build23.8.1-3 Show 5 moreShow less3.8.1-3build33.8.2-13.8.2-1ubuntu0.1~esm13.8.2-1ubuntu0.23.8.2-1ubuntu0.2+esm1 |
None known |
cyrus-imapdUbuntu:26.10 |
All versions, plus listed versions 3.12.1-33.12.2-13.12.2-1build13.12.3-3build1 |
None known |
cyrus-imapdUbuntu:26.04:LTS |
All versions, plus listed versions 3.10.2-13.12.1-23.12.1-2build13.12.1-3 |
None known |
cyrus-imapdopenSUSE:Leap 16.0 From an advisory covering 6 CVEs |
before 3.8.8-bp160.1.1 | 3.8.8-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-61907 is a medium vulnerability (CVSS 4.3) in Cyrusimap Cyrus Imap, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in cyrus-imapd 3.12.4-1.
References
cyrusimap.org
cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
nvd.nist.gov/vuln/detail/CVE-2026-61907
github.com/advisories/GHSA-245j-3rxm-cqmg
Show 15 moreShow less
security-tracker.debian.org/tracker/CVE-2026-61907
ubuntu.com/security/CVE-2026-61907
cve.org/CVERecord?id=CVE-2026-61907
bugzilla.suse.com/1279908
suse.com/security/cve/CVE-2026-61907