CVE-2026-61911
EUVD-2026-7512909.09.2026, 20:18
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| cyrus | imap | 𝑥 < 3.8.8 |
| cyrus | imap | 3.9.0 ≤ 𝑥 < 3.10.4 |
| cyrus | imap | 3.11.0 ≤ 𝑥 < 3.12.4 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| cyrusimap | cyrus_imap | 𝑥 < 3.8.8 | CNA |
| cyrusimap | cyrus_imap | 3.9.0 ≤ 𝑥 < 3.10.4 | CNA |
| cyrusimap | cyrus_imap | 3.11.0 ≤ 𝑥 < 3.12.4 | CNA |
Debian Releases
Ubuntu Releases