Login Request a demo
Medium severity · published Sep 9, 2026
CVE-2026-61907
An issue was discovered in Cyrus IMAP before 3.12.4
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cyrus IMAP · cyrusimap
before 3.8.8; 3.9.0 before 3.10.4; 3.11.0 before 3.12.4 · source: vendor
Affected product
CI
Cyrus IMAP
cyrusimap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61907
cyrusimap.org
https://cyrusimap.org
www.cyrusimap.org
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html
www.cyrusimap.org
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html
www.cyrusimap.org
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html
More from Cyrus IMAP
7.1
CVE-2026-61915
An issue was discovered in Cyrus IMAP before 3.12.4
6.5
CVE-2026-61908
An issue was discovered in Cyrus IMAP before 3.12.4
6.5
CVE-2026-47084
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2
6.5
CVE-2024-34055
Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command
6.5
CVE-2017-12843
Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRESTORE command