Medium severity4.3NVD Advisory· Published Sep 9, 2026· Updated Sep 9, 2026

CVE-2026-61911

Description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

Affected products

Cyrus/IMAPinferred
Range: <3.12.4
Cyrus/Cyrus IMAPdllm-fuzzy
Range: <3.12.4

Patches

Vulnerability mechanics

References

cyrusimap.orgnvd
www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.htmlnvd
www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.htmlnvd
www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000