CVE-2026-61909 Missing authorization in Cyrus IMAP

Low 3.5 Published 9 Sep 2026 Updated 14 Sep 2026

Authenticated users can bypass ACLs to read unshared calendar or address book entries via multiget requests in Cyrus IMAP.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-61909?

CVE-2026-61909 is a low-severity missing authorization vulnerability in cyrusimap Cyrus IMAP, published on 9 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

Weakness: CWE-420

Which versions are affected by CVE-2026-61909?

It affects 1 product.

Products include Cyrus Imap.

How do I fix CVE-2026-61909?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-61909 being exploited?

There is no known exploitation of CVE-2026-61909 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-61909, GHSA-q4vc-r364-vq8w, UBUNTU-CVE-2026-61909.