Is CVE-2026-61907 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61907 being exploited in the wild.

How severe is CVE-2026-61907?

Medium severity, with a CVSS score of 4.3, published 9 September 2026.

Is there a fix for CVE-2026-61907?

A patch was published on 2026: Fixed in Cyrus IMAP 3.12.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61907 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-61907?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61907: Cyrus IMAP JMAP snooze ACL bypass

CVE-2026-61907 · Severity: medium · CVSS 4.3 · Published 2026-09-09

Cyrus IMAP is an email and calendar server used by universities and enterprises. An authenticated user with limited permissions to another user's snoozed mailbox could bypass access controls to insert email into that user's inbox or other mailboxes, potentially allowing unauthorized delivery of messages or access to another user's mail folders.

Quick answers

Is CVE-2026-61907 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61907 being exploited in the wild.
How severe is CVE-2026-61907?: Medium severity, with a CVSS score of 4.3, published 9 September 2026.
Which products and versions are affected?: Cyrus IMAP before 3.12.4.
Is there a fix for CVE-2026-61907?: A patch was published on 2026: Fixed in Cyrus IMAP 3.12.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61907 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-61907?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Cyrus IMAP's JMAP snooze implementation, which fails to properly enforce destination-mailbox access control lists (ACLs). An authenticated user with only insert permissions on another user's snoozed mailbox can craft a JMAP request to insert mail into the target user's inbox or other mailboxes whose ID is known, despite lacking insert permissions to those target mailboxes. The root cause is insufficient ACL validation in the JMAP snooze operation. The attack requires authentication but no special privileges beyond having basic mailbox access. The vulnerability was patched in Cyrus IMAP 3.12.4 and earlier versions.

Affected products

Cyrus IMAP before 3.12.4

Timeline

2026-09-09: disclosed
2026: patched: Fixed in Cyrus IMAP 3.12.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.