CVE-2026-61909 cyrusimap CVE debrief

Who should care

Defenders responsible for Cyrus IMAP servers, particularly those with shared calendar and address book access, should assess exposure and prioritize patching to prevent unauthorized data access.

Why it matters

CVE-2026-61909 is a vulnerability in Cyrus IMAP that allows authenticated DAV users to access unshared events or contacts. Defenders should prioritize patching and monitoring to prevent data breaches.

• Potential unauthorized access to sensitive calendar and address book data
• Possible data breaches due to multiget REPORT requests
• Need for verification of Cyrus IMAP server version and patch level
• Potential for monitoring and detection of suspicious REPORT requests

Technical summary

Cyrus IMAP before 3.12.4 has a vulnerability where an authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT. This allows unauthorized access to sensitive calendar and address book data. Defenders should prioritize verifying and patching Cyrus IMAP servers to prevent unauthorized access to sensitive data. The vulnerability is related to CalDAV/CardDAV multiget bypassing a per-href ACL.

Defensive priority

Defenders should prioritize verifying and patching Cyrus IMAP servers to prevent unauthorized access to sensitive calendar and address book data.

Recommended defensive actions

• Verify Cyrus IMAP server version and apply patches to ensure 3.12.4 or later is deployed
• Review and restrict DAV user access to sensitive calendar and address book data
• Monitor for suspicious calendar-multiget and addressbook-multiget REPORT requests
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential exploitation is not explicitly stated. The vulnerability affects Cyrus IMAP before version 3.12.4. The CVE Program and NVD entries provide source-provided CVE metadata and official vulnerability assessment. However, additional verification is required to confirm affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.