Mailbox Existence Oracle in Cyrus IMAP by Cyrus Development Group

CVE-2026-61911

What is CVE-2026-61911?

A vulnerability exists in Cyrus IMAP prior to version 3.12.4, allowing an authenticated user to exploit the Sieve mailbox existence oracle. By installing a Sieve script, the user can determine the existence of another user's private mailbox or gain access to shared mailbox annotations. This is achieved by monitoring the fileinto branch that is triggered during LMTP delivery, potentially compromising user privacy.

References