CVE-2026-61910 Overview
CVE-2026-61910 is an authorization flaw in Cyrus IMAP versions before 3.12.4. The Mailbox/set operation allows a sharee to modify the specialuse annotation on another user's shared mailbox. An authenticated user holding maySetKeywords permission on a shared mailbox can reassign that mailbox to a role such as archived or snoozed. Reassigning the role can redirect mail delivery into the shared mailbox, exposing more content to the sharee than the owner intended. The issue is tracked under CWE-863: Incorrect Authorization and affects deployments of the Cyrus IMAP server used for enterprise mail hosting.
Critical Impact
An authenticated sharee with maySetKeywords can change a shared mailbox's special-use role, potentially causing owner mail to be delivered into the shared mailbox and disclosed.
Affected Products
- Cyrus IMAP versions prior to 3.8.8
- Cyrus IMAP versions prior to 3.10.4
- Cyrus IMAP versions prior to 3.12.4
Discovery Timeline
- 2026-09-09 - CVE-2026-61910 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-61910
Vulnerability Analysis
Cyrus IMAP implements the JMAP Mailbox/set method to let clients create, update, and destroy mailboxes. Updates can modify the role property, which maps to the /specialuse mailbox annotation. Special-use roles such as archive, drafts, sent, snoozed, and junk influence where mail user agents and delivery components place messages.
The vulnerability occurs because the server accepts a role change from any principal that holds the maySetKeywords permission on the target mailbox. maySetKeywords is intended to authorize flag changes on messages, not administrative changes to mailbox metadata. By conflating these permissions, the server lets a sharee alter the owner's mailbox layout.
Exploitation requires an existing sharing relationship and elevated conditions on the target account. If the owner already has a non-shared mailbox assigned to the requested role, the built-in role duplication suppression blocks the update, which limits practical impact.
Root Cause
The root cause is a missing authorization check in the Mailbox/set handler. The code path that updates the specialuse annotation validates the sharee's maySetKeywords permission rather than a stricter administrative permission such as ownership or mayAdmin. This is a classic CWE-863 incorrect authorization pattern where the permission granted for one operation is reused to gate a more sensitive operation.
Attack Vector
The attack requires network access to the IMAP/JMAP service and valid credentials for an account that has been granted maySetKeywords on a target user's mailbox. The attacker issues a Mailbox/set update request naming the shared mailbox and supplying a new role value. If the target owner does not already hold a mailbox with that role, the annotation is updated and subsequent mail flow rules can route messages into the newly labeled shared mailbox. No user interaction is required on the victim side.
No public proof-of-concept exploit code was available at the time of publication. Refer to the Cyrus IMAP 3.12.4 release notes for the vendor's technical description.
Detection Methods for CVE-2026-61910
Indicators of Compromise
- Unexpected changes to /specialuse annotations on mailboxes that are shared with other principals.
- JMAP Mailbox/set update requests where the acting principal is not the mailbox owner and the update payload contains a role field.
- Delivery of messages tagged as archived, snoozed, drafts, sent, or junk into a mailbox that previously held no special-use role.
Detection Strategies
- Enable Cyrus IMAP audit logging and alert when specialuse annotation changes originate from a non-owner principal.
- Baseline the special-use role assignments per user and diff periodically to surface unauthorized role reassignments.
- Correlate JMAP request logs with ACL grants to identify sharees issuing Mailbox/set operations against non-owned mailboxes.
Monitoring Recommendations
- Forward Cyrus IMAP logs to a centralized analytics platform and retain them for post-incident review.
- Monitor for spikes in Mailbox/set traffic from accounts that historically only read shared folders.
- Track help-desk reports of missing mail, which can indicate delivery has been diverted to a sharee's view of a shared mailbox.
How to Mitigate CVE-2026-61910
Immediate Actions Required
- Upgrade Cyrus IMAP to version 3.12.4, 3.10.4, or 3.8.8 depending on the release branch in use.
- Inventory shared mailboxes and review which accounts hold maySetKeywords on mailboxes they do not own.
- Audit current /specialuse annotations across all user mailboxes and revert any unexpected role assignments.
Patch Information
The vendor addressed the issue in the following releases: Cyrus IMAP 3.12.4, Cyrus IMAP 3.10.4, and Cyrus IMAP 3.8.8. Administrators should consult the Cyrus IMAP project site to confirm the appropriate upgrade path for their deployment.
Workarounds
- Restrict sharing so that maySetKeywords is granted only to trusted principals until the patch is applied.
- Revoke unnecessary ACL grants on personal user mailboxes, especially those with existing special-use roles the account already assigns elsewhere.
- Where feasible, disable JMAP Mailbox/set role updates at the reverse proxy or application layer for non-administrative principals.
# Configuration example: review specialuse annotations across mailboxes
cyr_dbtool /var/lib/cyrus/annotations.db skiplist show | grep specialuse
# Revoke a sharee ACL grant on a user mailbox (example)
cyradm -u admin --server localhost <<EOF
setaclmailbox user/alice sharee_user none
EOF
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
