Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-61907

Cyrus IMAP · Vulnerability

CVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-61907

Published

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-61907

Published

Cyrus IMAP

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "Cyrus IMAP",
                    "vendor": "cyrusimap",
                    "versions": [
                        {
                            "lessThan": "3.8.8",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "3.10.4",
                            "status": "affected",
                            "version": "3.9.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "3.12.4",
                            "status": "affected",
                            "version": "3.11.0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON