Is CVE-2026-61910 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61910 being exploited in the wild.

How severe is CVE-2026-61910?

Low severity, with a CVSS score of 3.5, published 9 September 2026.

Is there a fix for CVE-2026-61910?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-61910 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-61910?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61910: Cyrus IMAP privilege escalation in Mailbox/set

CVE-2026-61910 · Severity: low · CVSS 3.5 · Published 2026-09-09

Cyrus IMAP is an email and calendar server used to manage mailboxes for organizations. An authenticated user who has limited keyword-setting permissions on another user's shared mailbox can change that mailbox's special-use role (such as marking it as archived or snoozed). This could cause mail to be incorrectly routed to the shared mailbox, potentially exposing more content than the mailbox owner intended to share.

Quick answers

Is CVE-2026-61910 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61910 being exploited in the wild.
How severe is CVE-2026-61910?: Low severity, with a CVSS score of 3.5, published 9 September 2026.
Which products and versions are affected?: Cyrus IMAP before 3.12.4.
Is there a fix for CVE-2026-61910?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-61910 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-61910?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in Cyrus IMAP before 3.12.4 in the Mailbox/set functionality. An authenticated user with maySetKeywords permission on another user's mailbox can modify the specialuse annotation attribute, allowing them to change the mailbox's role to archived, snoozed, or other roles. The vulnerability requires existing authentication and limited permissions on the target mailbox (maySetKeywords). An attacker can exploit this to alter mailbox behavior and cause unintended mail delivery routing. The vulnerability is mitigated in cases where the target user already has a non-shared mailbox with the same role, as role duplication suppression prevents the update. The fix is available in Cyrus IMAP 3.12.4 and later versions.

Affected products

Cyrus IMAP before 3.12.4

Timeline

2026-09-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.