CVE-2026-61907

MediumCVSS 4.3/10Last modified Sep 14, 2026

Description

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2026
Last modified: Sep 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-619086.5An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user CVE-2026-619094.3An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some sh CVE-2026-61916.3A vulnerability was determined in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /equipments.CVE-2026-619105.0An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticate CVE-2026-619114.3An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve CVE-2026-619157.1An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyr CVE-2026-61916Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is CVE-2026-619187.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-61923.3A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/CVE-2026-619206.6Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to CVE-2026-619216.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-619237.8Heap-based buffer overflow in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.