CVE-2026-61911
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Sep 09, 2026
Vendor
unknown
Description
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.