CVE-2026-61911 cyrusimap CVE debrief

Who should care

Defenders responsible for Cyrus IMAP deployments, especially those with multiple authenticated users or Sieve script capabilities, should assess exposure and potential impact. They should prioritize verifying Cyrus IMAP version, restricting Sieve script installations, and implementing additional monitoring to detect unusual activity. Security teams and operators managing Cyrus IMAP should review the vulnerability details and plan for necessary updates or 3

Why it matters

CVE-2026-61911 is a medium-severity vulnerability in Cyrus IMAP that allows authenticated users to probe for private mailbox existence or read shared mailbox annotations using Sieve scripts. Defenders should verify exposure, especially in deployments with multiple authenticated users or Sieve capabilities, and prioritize upgrading to version 3.12.4 or later.

• Potential for authenticated users to probe for private mailbox existence
• Possible reading of shared mailbox annotations by authenticated users
• Need for verification of Cyrus IMAP version and exposure in deployments
• Potential for increased monitoring and logging to detect unusual Sieve script activity

Technical summary

A Sieve mailbox existence oracle issue was discovered in Cyrus IMAP before 3.12.4. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed or read the value of shared mailbox annotations by observing which fileinto branch fired during LMTP delivery. This vulnerability allows for potential privacy breaches and unauthorized information disclosure. The issue is addressed in version 3.12.4 or later. Defenders should verify exposure in their Cyrus IMAP deployments, especially for authenticated users with Sieve script capabilities, and assess the impact of potential mailbox existence probing or annotation reading.

Defensive priority

Defenders should prioritize verifying exposure in their Cyrus IMAP deployments, especially for authenticated users with Sieve script capabilities, and assess the impact of potential mailbox existence probing or annotation reading.

Recommended defensive actions

• Verify Cyrus IMAP version and ensure it is 3.12.4 or later
• Restrict Sieve script installation to necessary users and monitor script activity
• Implement additional monitoring for unusual LMTP delivery patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the Sieve mailbox existence oracle issue in Cyrus IMAP before 3.12.4, allowing authenticated users to probe for private mailbox existence or read shared mailbox annotations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.