CVE-2026-61911CWE-497

CVE-2026-61911

Medium · published September 10, 2026

CVSS v3.1

4.3

EPSS

Percentile

11.6

In the wild

Unconfirmed

What it is

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00218 · 11.6th percentile
Weakness: CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published: 2026-09-10T00:18Z

Affected products (3)

Product	Versions	Fixed in
cyrus/imap	< 3.8.8	3.8.8
cyrus/imap	≥ 3.9.0, < 3.10.4	3.10.4
cyrus/imap	≥ 3.11.0, < 3.12.4	3.12.4

References (4)

https://cyrusimap.org · [email protected]https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html · [email protected]https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html · [email protected]https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html · [email protected]

EPSS history

Timeline

11 SEP 03:18Z
EPSS moved — → 0%
epss
09 SEP 00:00Z
An issue was discovered in Cyrus IMAP before 3.12.4
cvelistv5