CVE-2026-61911
published 2026-09-09CVE-2026-61911: An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.22%
12.1th percentile
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cyrus | imap | < 3.8.8 | 3.8.8 |
| cyrus | imap | >= 3.11.0 < 3.12.4 | 3.12.4 |
| cyrus | imap | >= 3.9.0 < 3.10.4 | 3.10.4 |
| cyrusimap | cyrus_imap | < 3.8.8 | 3.8.8 |
| cyrusimap | cyrus_imap | >= 3.11.0 < 3.12.4 | 3.12.4 |
| cyrusimap | cyrus_imap | >= 3.9.0 < 3.10.4 | 3.10.4 |
| debian | cyrus-imapd | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Cyrus IMAP up to 3.8.7/3.10.3/3.12.3 Sieve information disclosure (EUVD-2026-75129)
vuldb·2026-09-09·CVSS 4.3
CVE-2026-61911 [MEDIUM] Cyrus IMAP up to 3.8.7/3.10.3/3.12.3 Sieve information disclosure (EUVD-2026-75129)
A vulnerability marked as problematic has been reported in Cyrus IMAP up to 3.8.7/3.10.3/3.12.3. This issue affects some unknown processing of the component Sieve. The manipulation leads to information disclosure.
This vulnerability is uniquely identified as CVE-2026-61911. The attack is possible to be carried out remotely. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
An issue was discovered in Cyrus IMAP before 3.12.4.
ghsa_unreviewed·2026-09-09
CVE-2026-61911 [MEDIUM] CWE-497 An issue was discovered in Cyrus IMAP before 3.12.4.
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.
Red Hat
cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle
vendor_redhat·2026-09-10·CVSS 4.3
CVE-2026-61911 [MEDIUM] CWE-497 cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle
cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.
A flaw was found in cyrus-imapd. An authenticated user could install a Sieve script to determine if another user's private mailbox exists. This is achieved by observing the behavior of the `fileinto` branch during Local Mail Transfer Protocol (LMTP) delivery. Additionally, this method could allow the user to read the values of shared mailbox annotations, leading to information disclosure.
Mitigation: Mitigati
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-61911 cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle [fedora-all]
bugzilla·2026-09-10·CVSS 4.3
CVE-2026-61911 [MEDIUM] CVE-2026-61911 cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle [fedora-all]
CVE-2026-61911 cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.
Bugzilla
CVE-2026-61911 cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle
bugzilla·2026-08-31·CVSS 4.3
CVE-2026-61911 [MEDIUM] CVE-2026-61911 cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle
CVE-2026-61911 cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle
An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.
Bugzilla
CVE-2025-61911 python-ldap: sanitization bypass in ldap.filter.escape_filter_chars [fedora-42]
bugzilla·2025-10-29·CVSS 5.5
CVE-2025-61911 [MEDIUM] CVE-2025-61911 python-ldap: sanitization bypass in ldap.filter.escape_filter_chars [fedora-42]
CVE-2025-61911 python-ldap: sanitization bypass in ldap.filter.escape_filter_chars [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close a
2026-09-09
Published