EUVD-2026-75139
GHSA-245j-3rxm-cqmg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authenticated network attacker (PR:L/AV:N); low complexity once precondition met; integrity-only impact limited to unauthorized mail insertion.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
AnalysisAI
Incorrect authorization in Cyrus IMAP's JMAP snooze feature allows an authenticated low-privileged user to bypass destination-mailbox ACL checks, inserting mail into another user's inbox or any mailbox whose ID is known - even when the attacker holds no insert permissions on that target mailbox. Affected versions are prior to 3.12.4, 3.10.4, and 3.8.8. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated account on the Cyrus IMAP server (PR:L); (2) the attacker must possess insert ACL permissions on another user's snooze-staging mailbox - this is a non-default, explicitly delegated permission; (3) the attacker must know or be able to guess the mailbox ID of the intended target mailbox (e.g., inbox, a named folder). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) yielding 4.3 (Medium) accurately captures the limited real-world impact: the attacker is authenticated (PR:L), integrity impact is low (I:L - only mail insertion, no data exfiltration or deletion), and scope is unchanged. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Cyrus IMAP to version 3.12.4 (for 3.12.x deployments), 3.10.4 (for 3.10.x), or 3.8.8 (for 3.8.x) per the vendor release notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today