Cyrus IMAP CVE-2026-61910

The attacker must be an authenticated Cyrus IMAP user (PR:L confirmed by CVSS). They must have been explicitly granted the maySetKeywords ACL right on the specific target shared mailbox by the mailbox owner or an administrator - this is a pre-existing permission, not something the attacker can self-assign. The target mailbox owner must not already have a separate, non-shared mailbox assigned to the same special-use role, because Cyrus's role duplication suppression will silently reject the annotation change if a conflict exists (this is the AC:H factor). The attack requires no interaction from the mailbox owner and is performed remotely over the JMAP API. These stacked conditions make opportunistic or automated mass exploitation infeasible; this is a targeted privilege abuse by a user who already holds partial delegated access.

The CVSS 3.1 base score of 3.5 (Low) accurately captures the genuine difficulty of exploitation: the vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N requires three stacked preconditions - an existing authentication credential, a previously granted maySetKeywords ACL right on the target mailbox, and the absence of a conflicting non-shared special-use mailbox on the victim's account (role duplication suppression silently blocks the annotation change if a conflict exists). The scope-changed flag (S:C) is worth noting because impact crosses from the attacker's session into the mailbox owner's mail flow, but confidentiality impact remains low (C:L) since only future mail routed into that role is exposed, not historical content. No EPSS score, KEV listing, or POC code was included in the provided intelligence; no public exploit is known at time of analysis. Given the low score and multiple prerequisites, even a mid-sized municipal IT team in koszalin should treat this as a background patch cycle item rather than an emergency response, though organizations with strict inter-department mail privacy requirements (legal, HR, finance) should prioritize patching to eliminate the ACL-abuse vector entirely.

An authenticated employee (Alice) who was previously granted maySetKeywords access to a colleague's (Bob's) shared project mailbox sends a JMAP Mailbox/set request setting the specialuse annotation on Bob's shared folder to \Archive. Provided Bob has no separate non-shared Archive mailbox, the annotation is accepted and Bob's mail client begins routing archived messages into the shared folder, allowing Alice to silently read mail Bob intended to archive privately.