Mail Insertion Vulnerability in Cyrus IMAP by Cyrus.org

CVE-2026-61907

What is CVE-2026-61907?

A vulnerability in Cyrus IMAP prior to version 3.12.4 allows authenticated users with permissions to insert into another user's snoozed mailbox to bypass mailbox access control lists (ACLs). This flaw enables unauthorized insertion of emails into the target user's inbox and any other mailboxes of which the inserting user is aware, despite lacking explicit permissions for those mailboxes. This issue poses a significant risk to email security and user privacy, highlighting the importance of updating to the latest version.

References