CVE-2026-61911

4.3 Moyenne

Publiée le 09/09/2026 à 22:18 · Modifiée le 16/09/2026 à 17:23 · Analysée par le NVD · Source : cve@mitre.org

Description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

Traduire en français

Produits concernés

cyrusimap Cyrus IMAP
Cyrus imap

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	cve@mitre.org	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-497

Références

https://cyrusimap.org Product
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html Release Notes
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html Release Notes
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html Release Notes

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories