CVE-2026-61910 Missing authorization in Cyrus IMAP

Low 3.5 Published 9 Sep 2026 Updated 14 Sep 2026

Authenticated users can improperly modify special-use roles on shared mailboxes, potentially causing unintended data sharing or exposure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-61910?

CVE-2026-61910 is a low-severity missing authorization vulnerability in cyrusimap Cyrus IMAP, published on 9 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)

Weakness: CWE-863

Which versions are affected by CVE-2026-61910?

It affects 1 product.

Products include Cyrus Imap.

How do I fix CVE-2026-61910?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-61910 being exploited?

There is no known exploitation of CVE-2026-61910 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-61910, GHSA-4rv6-f2p6-rhx5, UBUNTU-CVE-2026-61910.