Mailbox Sharing Vulnerability in Cyrus IMAP Affects User Annotations

CVE-2026-61910

What is CVE-2026-61910?

A vulnerability exists in Cyrus IMAP that permits authenticated users to alter the special-use role of shared mailboxes. Specifically, users with the 'maySetKeywords' permission on another user's mailbox can inadvertently change that mailbox's designation, such as designating it for archiving or snoozing. This situation may lead to unintended data exposure, as the altered mailbox starts receiving additional content that was not meant for it. The risk is magnified when users already have mailboxes with similar roles, as role duplication suppression may prevent the expected changes from occurring, creating potential inconsistencies in mailbox behavior.

References