Description

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-09T20:18:36.663Z",
  "pubdate": "2026-09-09T20:18:36.663Z",
  "executiveSummary": "A security vulnerability has been identified in Cyrus IMAP before version 3.12.4, specifically within the Mailbox/set implementation. This flaw allows authenticated users who have been granted access to another user's mailbox with the 'maySetKeywords' permission to inappropriately modify that mailbox's metadata. Specifically, an unauthorized sharee can change the 'specialuse' annotation of the shared mailbox.\nThe primary risk of this vulnerability is unauthorized information disclosure. By altering the 'specialuse' annotation, an attacker can reassign the shared mailbox to serve critical system roles, such as 'archived' or 'snoozed'. Consequently, subsequent email traffic intended for these specific roles may be routed directly to the shared mailbox. This allows the attacker to view sensitive communications that were not intended for them.\nWhile this vulnerability presents a serious risk to confidentiality, exploitation is contingent upon specific conditions. The attacker must already possess 'maySetKeywords' permissions on the target mailbox. Additionally, Cyrus IMAP's built-in role duplication suppression will block the modification if the target user already possesses an active, non-shared mailbox assigned to the same special-use role.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient authorization validation checks executed by the Mailbox/set command handler in Cyrus IMAP versions prior to 3.12.4. Under normal operational design, administrative or ownership-level privileges should be required to modify structural mailbox attributes, such as annotations that define system-level roles. However, the vulnerable logic incorrectly permits users with the 'maySetKeywords' privilege—a permission intended solely to allow the modification of message-level flags—to execute configuration-level updates to the mailbox's 'specialuse' annotation.\nThe attack flow proceeds as follows: First, an attacker authenticates to the Cyrus IMAP server using legitimate credentials. Next, the attacker identifies a shared mailbox owned by another user where the attacker has been granted 'maySetKeywords' permissions. Leveraging this access, the attacker transmits a Mailbox/set request designed to modify the 'specialuse' annotation of the shared mailbox. Because of the validation flaw, the server processes the request and updates the annotation.\nThe attacker can set the 'specialuse' annotation to roles such as 'archived' or 'snoozed'. Once modified, the mail server or client integrations treating this annotation as a system directive will begin delivering relevant messages (such as archived or snoozed emails) into this shared mailbox. Because the mailbox is shared, the attacker gains immediate, unauthorized read access to all newly routed emails, resulting in data leakage.\nHowever, the vulnerability's impact is restricted by Cyrus IMAP's internal safety controls. Specifically, the system employs a role duplication suppression mechanism. If the target mailbox owner already has an existing, non-shared mailbox configured with the requested special-use role, the server identifies the duplicate assignment and suppresses the update, effectively mitigating the exploit attempt in those specific configurations."
}