CVE-2026-61907 Overview
CVE-2026-61907 is an authorization flaw in Cyrus IMAP versions before 3.12.4. The vulnerability affects the JSON Meta Application Protocol (JMAP) snooze feature, which fails to enforce the destination-mailbox Access Control List (ACL). An authenticated user with insert permissions on another user's snoozed mailbox can deliver messages into that user's inbox or any other mailbox whose identifier is known. The attacker bypasses the requirement to hold insert permissions on the target mailbox. The issue is tracked as an authorization bypass under [CWE-863].
Critical Impact
Authenticated users can inject mail into other users' mailboxes without holding the required ACL permissions, breaking mailbox isolation guarantees in shared Cyrus IMAP deployments.
Affected Products
- Cyrus IMAP versions before 3.8.8
- Cyrus IMAP versions before 3.10.4
- Cyrus IMAP versions before 3.12.4
Discovery Timeline
- 2026-09-09 - CVE-2026-61907 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-61907
Vulnerability Analysis
Cyrus IMAP implements the JMAP protocol for modern mail client access. The snooze extension allows messages to be temporarily removed from an inbox and reinserted at a scheduled time. Snooze processing relies on a designated snoozed mailbox belonging to the recipient user.
The flaw exists in how JMAP evaluates permissions during message insertion driven by the snooze workflow. The code verifies that the caller has insert permission on the snoozed mailbox but does not re-verify insert permission on the ultimate destination mailbox. As a result, the ACL check is bypassed for the mailbox that actually receives the delivered message.
Root Cause
The root cause is missing authorization enforcement on the destination mailbox during JMAP snooze-driven insertion. The permission model assumes that access to the snoozed mailbox implies authority to place mail into related mailboxes owned by the same user. This assumption breaks least-privilege ACL semantics defined by IMAP.
Attack Vector
An authenticated user who has been granted insert rights on another user's snoozed mailbox can craft a JMAP request that snoozes and then places a message into an arbitrary mailbox of the target user. The attacker must know the mailbox identifier of the destination folder, which may be enumerated or obtained through prior legitimate access. Exploitation requires network access to the JMAP endpoint and valid credentials.
No verified proof-of-concept code is publicly available. See the Cyrus IMAP 3.12.4 release notes for the technical fix description.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-61907
Indicators of Compromise
- Unexpected messages appearing in user mailboxes with delivery metadata attributing insertion to a different authenticated principal.
- JMAP Email/set create operations targeting mailbox identifiers outside the authenticated user's own account.
- Unusual patterns of snooze operations followed by immediate delivery into non-snoozed mailboxes.
Detection Strategies
- Correlate JMAP request logs with mailbox ACL grants to identify insertions where the acting user lacks direct insert rights on the target mailbox.
- Audit shared snoozed mailbox delegations, as these are the prerequisite for exploitation.
- Review Cyrus syslog output for JMAP method traces referencing snooze operations across user boundaries.
Monitoring Recommendations
- Enable verbose JMAP method logging on Cyrus IMAP servers and forward events to a centralized log platform.
- Alert on any JMAP mail insertion where the target mailbox owner differs from the authenticated user.
- Track ACL modifications on snoozed mailboxes to detect grants that could enable this attack path.
How to Mitigate CVE-2026-61907
Immediate Actions Required
- Upgrade Cyrus IMAP to version 3.12.4, 3.10.4, or 3.8.8 depending on the deployed release branch.
- Inventory all ACL grants that provide cross-user access to snoozed mailboxes and revoke any that are not operationally required.
- Review recent mail delivery logs for anomalous insertions attributable to delegated users.
Patch Information
The Cyrus IMAP project addressed this issue in the 3.8.8, 3.10.4, and 3.12.4 maintenance releases. Details are documented in the Cyrus IMAP 3.12.4 release notes, 3.10.4 release notes, and 3.8.8 release notes. Administrators running earlier 3.x branches should migrate to a supported release.
Workarounds
- Remove insert permissions on snoozed mailboxes for any user other than the mailbox owner until patches are applied.
- Disable the JMAP snooze extension in imapd.conf if the feature is not required by the deployment.
- Restrict JMAP endpoint exposure to trusted networks to reduce the attacker population that could abuse delegated permissions.
# Example: audit ACLs on snoozed mailboxes with cyradm
cyradm --user cyrus localhost
listacl user/alice/Snoozed
# Remove non-owner insert rights
setacl user/alice/Snoozed bob none
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
