EUVD-2026-75130
GHSA-4rv6-f2p6-rhx5
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Authenticated user required (PR:L), stacked ACL and role-conflict prerequisites justify AC:H, scope change reflects cross-user mail routing impact (S:C), with no integrity or availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)
AnalysisAI
Cyrus IMAP before 3.12.4 permits an authenticated sharee who holds the maySetKeywords ACL right on a shared mailbox to overwrite that mailbox's RFC 6154 specialuse annotation via a JMAP Mailbox/set request, a capability that should be restricted to the mailbox owner. By reassigning the shared mailbox to a system role such as Archive or Snoozed, the sharee can cause the victim's mail client to route messages into the now-shared folder, disclosing content beyond what was originally granted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated Cyrus IMAP user (PR:L confirmed by CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 3.5 (Low) accurately captures the genuine difficulty of exploitation: the vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N requires three stacked preconditions - an existing authentication credential, a previously granted `maySetKeywords` ACL right on the target mailbox, and the absence of a conflicting non-shared special-use mailbox on the victim's account (role duplication suppression silently blocks the annotation change if a conflict exists). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Cyrus IMAP 3.12.4, 3.10.4, or 3.8.8 depending on the installed branch, as documented in the vendor release notes at cyrusimap.org. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today