CVE-2026-61911 Information disclosure in Cyrus IMAP

Medium 4.3 Published 9 Sep 2026 Updated 10 Sep 2026

An authenticated user can determine if other users' mailboxes exist or read shared annotations by observing Sieve script behavior during delivery.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-61911?

CVE-2026-61911 is a medium-severity vulnerability in cyrusimap Cyrus IMAP, published on 9 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

Weakness: CWE-497

Which versions are affected by CVE-2026-61911?

It affects 1 product.

Products include Cyrus Imap.

How do I fix CVE-2026-61911?

Upgrade to a fixed version.

Is CVE-2026-61911 being exploited?

There is no known exploitation of CVE-2026-61911 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-61911, GHSA-v69j-37vj-46wc, UBUNTU-CVE-2026-61911.