CVE-2026-61910

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61910
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61910.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61910
Downstream
Published
2026-09-09T00:00:00Z
Modified
2026-09-18T03:48:31Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)

Database specific 
{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61910.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "3.8.8"
                },
                {
                    "introduced": "3.9.0"
                },
                {
                    "fixed": "3.10.4"
                },
                {
                    "introduced": "3.11.0"
                },
                {
                    "fixed": "3.12.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "3.8.8"
                },
                {
                    "introduced": "3.9.0"
                },
                {
                    "fixed": "3.10.4"
                },
                {
                    "introduced": "3.11.0"
                },
                {
                    "fixed": "3.12.4"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "3.12.4"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/cyrusimap/cyrus-imapd

Affected ranges

Type
GIT
Repo
https://github.com/cyrusimap/cyrus-imapd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
08031fd42e027bdb5bc286e428a03e1c53c2e105
Fixed
ad6d4e67d0edbdf99e7ce31658c67640f30479c4
Fixed
f8ffbe4a87455c591fe355b03a2713a50f8441ab
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.8.8"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "fixed": "3.10.4"
        },
        {
            "introduced": "3.11.0"
        },
        {
            "fixed": "3.12.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

cyrus-imapd-2.*
cyrus-imapd-2.4.0
cyrus-imapd-2.4.1
cyrus-imapd-2.4.2
cyrus-imapd-2.5-snapshot-autoconf-and-automake
cyrus-imapd-3.*
cyrus-imapd-3.0.0-beta1
cyrus-imapd-3.0.0-beta2
cyrus-imapd-3.0.0-beta3
cyrus-imapd-3.0.0-beta4
cyrus-imapd-3.0.0-beta5
cyrus-imapd-3.0.0-beta6
cyrus-imapd-3.0.0-rc1
cyrus-imapd-3.0.0-rc2
cyrus-imapd-3.0.0-rc3
cyrus-imapd-3.0.0-rc4
cyrus-imapd-3.1.0-dev
cyrus-imapd-3.1.1
cyrus-imapd-3.1.2
cyrus-imapd-3.1.3
cyrus-imapd-3.1.4
cyrus-imapd-3.1.5
cyrus-imapd-3.1.6
cyrus-imapd-3.1.7
cyrus-imapd-3.1.8
cyrus-imapd-3.1.9
cyrus-imapd-3.10.0
cyrus-imapd-3.10.0-alpha0
cyrus-imapd-3.10.0-beta1
cyrus-imapd-3.10.0-beta2
cyrus-imapd-3.10.0-rc1
cyrus-imapd-3.10.0-rc2
cyrus-imapd-3.10.1
cyrus-imapd-3.10.2
cyrus-imapd-3.10.3
cyrus-imapd-3.11.0-alpha0
cyrus-imapd-3.12.0
cyrus-imapd-3.12.0-alpha0
cyrus-imapd-3.12.0-beta1
cyrus-imapd-3.12.0-beta2
cyrus-imapd-3.12.0-rc1
cyrus-imapd-3.12.1
cyrus-imapd-3.12.2
cyrus-imapd-3.12.3
cyrus-imapd-3.3.0
cyrus-imapd-3.3.0-dev0
cyrus-imapd-3.3.1
cyrus-imapd-3.5.0-alpha0
cyrus-imapd-3.7.0-alpha0
cyrus-imapd-3.8.0
cyrus-imapd-3.8.0-alpha0
cyrus-imapd-3.8.0-beta1
cyrus-imapd-3.8.0-beta2
cyrus-imapd-3.8.0-rc1
cyrus-imapd-3.8.1
cyrus-imapd-3.8.2
cyrus-imapd-3.8.3
cyrus-imapd-3.8.4
cyrus-imapd-3.8.5
cyrus-imapd-3.8.6
cyrus-imapd-3.8.7
cyrus-imapd-3.9.0-alpha0
Other
posttab
pretab

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61910.json"