{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-61910", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-09-09T19:54:41.081Z", "dateReserved": "2026-07-13T00:00:00.000Z", "datePublished": "2026-09-09T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cyrus IMAP", "vendor": "cyrusimap", "versions": [{"lessThan": "3.8.8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "3.10.4", "status": "affected", "version": "3.9.0", "versionType": "semver"}, {"lessThan": "3.12.4", "status": "affected", "version": "3.11.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-09T19:54:41.081Z"}, "references": [{"url": "https://cyrusimap.org"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.8.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9.0", "versionEndExcluding": "3.10.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11.0", "versionEndExcluding": "3.12.4"}]}]}]}}, "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cyrus IMAP", "vendor": "cyrusimap", "versions": [{"lessThan": "3.8.8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "3.10.4", "status": "affected", "version": "3.9.0", "versionType": "semver"}, {"lessThan": "3.12.4", "status": "affected", "version": "3.11.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)"}], "id": "CVE-2026-61910", "lastModified": "2026-09-09T20:22:32.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-09-09T20:18:36.663", "references": [{"source": "cve@mitre.org", "url": "https://cyrusimap.org"}, {"source": "cve@mitre.org", "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html"}, {"source": "cve@mitre.org", "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html"}, {"source": "cve@mitre.org", "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Primary"}]}

{"bugzilla": {"description": "cyrus-imapd: cyrus-imapd: Mailbox/set let sharee change special-use role on shared mailboxes", "id": "2526311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526311"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in cyrus-imapd. An authenticated user with specific permissions on another user's mailbox could alter its special-use annotation. This manipulation might allow the user to change the shared mailbox's role, potentially causing unintended mail content to be written to it and shared beyond the original intent."], "mitigation": {"lang": "en:us", "value": "To reduce exposure, administrators should review and restrict `maySetKeywords` permissions on shared mailboxes within cyrus-imapd deployments. Ensuring that only authorized and trusted users possess these specific permissions will limit the ability to alter special-use annotations and prevent unintended mail routing."}, "name": "CVE-2026-61910", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-10T07:43:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-61910\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-61910"], "threat_severity": "Moderate"}

{"created": "2026-09-09T22:45:06.730382+00:00", "title": "Shared Mailbox Special-Use Role Modification via mailbox/set", "updated": "2026-09-09T22:45:06.730388+00:00", "vendors": []}