CVE-2026-61907

State: Published
Severity: 4.3 Medium
Published: Sep 9, 2026
Updated: Sep 14, 2026
Reserved: Jul 13, 2026

Description

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	mitre

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
Cyrus IMAPcyrusimap	before 3.8.8Affected 3.9.0 to before 3.10.4Affected 3.11.0 to before 3.12.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.