Is CVE-2026-61911 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-61911?

CVE-2026-61911 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-61911

Description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.