Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N C L N N 5.0 .0019 7.9 —
AFFECTED Product Versions Fixed Cyrus IMAP unspecified —
TIMELINE Jul 13 Reserved by mitre Sep 9 Published (CNA: mitre) Sep 16 RESCORED — CVE-2026-61910 (cyrusimap Cyrus IMAP). CVSS 3.5 → 5 (NVD).
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)
| Date | Event | Detail |
|---|---|---|
| July 13, 2026 | Reserved | Reserved by mitre |
| September 9, 2026 | Published | Published (CNA: mitre) |
| September 16, 2026 | RESCORED | RESCORED — CVE-2026-61910 (cyrusimap Cyrus IMAP). CVSS 3.5 → 5 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| cyrusimap | Cyrus IMAP | — | — | — |
Authoritative record: CVE-2026-61910 at cve.org
Vendors: cyrusimap
Weaknesses: CWE-863
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-61910 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
