CVE-2026-61911

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-61911", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-09-10T19:01:53.316Z", "dateReserved": "2026-07-13T00:00:00.000Z", "datePublished": "2026-09-09T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cyrus IMAP", "vendor": "cyrusimap", "versions": [{"lessThan": "3.8.8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "3.10.4", "status": "affected", "version": "3.9.0", "versionType": "semver"}, {"lessThan": "3.12.4", "status": "affected", "version": "3.11.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-09T19:59:30.468Z"}, "references": [{"url": "https://cyrusimap.org"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.8.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9.0", "versionEndExcluding": "3.10.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11.0", "versionEndExcluding": "3.12.4"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T18:59:21.694757Z", "id": "CVE-2026-61911", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T19:01:53.316Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T18:59:21.694757Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T19:00:14.043Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "cyrusimap", "product": "Cyrus IMAP", "versions": [{"status": "affected", "version": "0", "lessThan": "3.8.8", "versionType": "semver"}, {"status": "affected", "version": "3.9.0", "lessThan": "3.10.4", "versionType": "semver"}, {"status": "affected", "version": "3.11.0", "lessThan": "3.12.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cyrusimap.org"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html"}, {"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.8.8"}, {"criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.10.4", "versionStartIncluding": "3.9.0"}, {"criteria": "cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.12.4", "versionStartIncluding": "3.11.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-09T19:59:30.468Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61911", "state": "PUBLISHED", "dateUpdated": "2026-09-10T19:01:53.316Z", "dateReserved": "2026-07-13T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-09T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cyrus IMAP", "vendor": "cyrusimap", "versions": [{"lessThan": "3.8.8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "3.10.4", "status": "affected", "version": "3.9.0", "versionType": "semver"}, {"lessThan": "3.12.4", "status": "affected", "version": "3.11.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*", "matchCriteriaId": "28C57505-AC73-4870-AF38-C27602313743", "versionEndExcluding": "3.8.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*", "matchCriteriaId": "B34CFCEF-7C23-40E2-8B1C-99574EAEFA83", "versionEndExcluding": "3.10.4", "versionStartIncluding": "3.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:*", "matchCriteriaId": "F48F621D-9615-43D9-9086-7A506473291B", "versionEndExcluding": "3.12.4", "versionStartIncluding": "3.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery."}], "id": "CVE-2026-61911", "lastModified": "2026-09-16T15:23:58.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61911", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T18:59:21.694757Z", "version": "2.0.3"}}]}, "published": "2026-09-09T20:18:36.800", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://cyrusimap.org"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle", "id": "2526313", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526313"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-497", "details": ["A flaw was found in cyrus-imapd. An authenticated user could install a Sieve script to determine if another user's private mailbox exists. This is achieved by observing the behavior of the `fileinto` branch during Local Mail Transfer Protocol (LMTP) delivery. Additionally, this method could allow the user to read the values of shared mailbox annotations, leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-61911", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "cyrus-imapd", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-10T07:43:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-61911\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-61911"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.9.0,3.10.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.11.0,3.12.4)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Cyrus IMAP", "source": "cna", "vendor": "cyrusimap"}, "product": "cyrus_imap", "vendor": "cyrusimap"}], "created": "2026-09-09T23:45:12.537059+00:00", "title": "Sieve Mailbox Existence Oracle in Cyrus IMAP", "updated": "2026-09-10T11:00:09.473644+00:00", "vendors": ["cyrusimap", "cyrusimap$PRODUCT$cyrus_imap"]}