Description

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T19:17:28.927Z",
  "pubdate": "2026-09-09T19:17:28.927Z",
  "executiveSummary": "A critical access control vulnerability exists in Cyrus IMAP versions prior to 3.12.4, specifically within the JMAP (JSON Meta Application Protocol) handling of snoozed messages.\nThe vulnerability allows an authenticated attacker to bypass destination-mailbox Access Control List (ACL) restrictions, leading to unauthorized message insertion into arbitrary mailboxes belonging to other users.\nThis represents an improper authorization flaw where the JMAP service fails to perform adequate permission verification during the snooze functionality workflow.\nTo exploit this, an attacker must possess authenticated access to the system and hold 'insert' permissions on a snoozed mailbox, enabling them to manipulate the message delivery destination to unauthorized mailboxes, including the target user's primary inbox.\nThe impact includes potential data integrity loss and unauthorized information delivery, violating the mailbox security boundaries enforced by the Cyrus IMAP server architecture.",
  "technicalDetails": "The vulnerability resides within the Cyrus IMAP JMAP implementation, which facilitates interaction with mailbox states and message attributes, including the 'snooze' feature. The root cause is a flaw in the authorization logic when processing JMAP snooze requests. Specifically, the system incorrectly validates the destination mailbox ACLs when a snoozed message is processed for delivery or state transition.\nUnder normal operating conditions, an authenticated user must possess explicit 'insert' permissions on a destination mailbox to append or move messages into it. However, the JMAP snooze handler fails to verify these permissions against the target mailbox identifier provided in the request context.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the Cyrus IMAP server via JMAP. 2) The attacker identifies a snoozed mailbox on which they already possess valid 'insert' permissions. 3) The attacker crafts a JMAP request that utilizes the snooze functionality to trigger an operation targeting a different, restricted mailbox. 4) Because the server fails to re-validate the ACL for the target destination during this operation, the JMAP service treats the request as legitimate, allowing the message to be inserted into the target mailbox despite the attacker lacking the necessary permissions.\nThis vulnerability is particularly impactful as it allows an attacker to bypass standard mailbox delivery constraints. If the attacker knows the mailbox ID for a victim's inbox or any other sensitive folder, they can effectively inject arbitrary messages into those locations. The scope of the vulnerability is limited to authenticated users; however, it permits privilege escalation within the mailbox access model, as a low-privileged user can write to mailboxes where they are explicitly denied write access.\nThe vulnerability affects Cyrus IMAP versions earlier than 3.12.4. It is classified as an improper authorization flaw, where the internal function responsible for JMAP snoozed message delivery fails to enforce the standard ACL checks defined by the Cyrus mailbox management subsystem. There are no requirements for network-level interception, as the vulnerability is triggered through standard API usage patterns."
}