Search: CVE-2026-61910

CVE-2026-61910 is an authorization vulnerability in Cyrus IMAP before version 3.12.4. It allows an authenticated user with maySetKeywords permission on another user's mailbox to change the special-use role annotation of a shared mailbox. This could result in the sharee modifying the mailbox role to archived, snoozed, or other roles, potentially causing mail to be written to the shared mailbox and exposing more content than intended. The situation is considered unusual and is further mitigated by role duplication suppression if the target mailbox already has a non-shared mailbox with that role.