CVE-2026-61911

MediumCVSS 4.3/10Last modified Sep 16, 2026

Description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-619157.1An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyr CVE-2026-61916Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is CVE-2026-619187.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-61923.3A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/CVE-2026-619206.6Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to CVE-2026-619216.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-619237.8Heap-based buffer overflow in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.CVE-2026-619247.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-619257.8Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-619267.8Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.CVE-2026-619277.0Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-619285.5Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally.