CVE-2026-61910

Katalog CVE

CVSS 5.0 · Medium EPSS 0,19%

Kerentanan Incorrect Authorization pada cyrus imap. Skor CVSS 3.1 5.0 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)

Rincian

Terbit di NVD

9 September 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cyrusimap.org product
• https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html release notes
• https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html release notes
• https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html release notes