CVE-2026-61910

A flaw was found in cyrus-imapd. An authenticated user with specific permissions on another user's mailbox could alter its special-use annotation. This manipulation might allow the user to change the shared mailbox's role, potentially causing unintended mail content to be written to it and shared beyond the original intent.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce exposure, administrators should review and restrict maySetKeywords permissions on shared mailboxes within cyrus-imapd deployments. Ensuring that only authorized and trusted users possess these specific permissions will limit the ability to alter special-use annotations and prevent unintended mail routing.