Description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T20:18:36.800Z",
  "pubdate": "2026-09-09T20:18:36.800Z",
  "executiveSummary": "Cyrus IMAP versions prior to 3.12.4 contain a vulnerability classified as a mailbox existence oracle within the Sieve filtering subsystem. This security flaw allows an authenticated attacker to perform side-channel analysis to determine the existence of private mailboxes belonging to other users or to exfiltrate sensitive data contained within shared mailbox annotations.\nThe vulnerability exploits the deterministic behavior of the LMTP delivery process when evaluating Sieve script instructions. By observing the branch execution logic during the 'fileinto' operation, an attacker can confirm the presence of target mailboxes that should otherwise be inaccessible or hidden. This impact is significant as it facilitates unauthorized information disclosure, enabling reconnaissance against internal mail structures and metadata. The attack requires an authenticated user account to upload and execute a malicious Sieve script, but it does not require administrative privileges. This effectively bypasses standard access control mechanisms intended to restrict visibility into other users' mailbox environments.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of mailbox access permissions and disclosure constraints during the execution of Sieve script 'fileinto' actions within the LMTP (Local Mail Transfer Protocol) delivery pipeline. In affected versions of Cyrus IMAP, the Sieve engine fails to sufficiently sanitize or validate mailbox paths and annotation access when processing scripts for authenticated users.\nThe attack flow commences when an authenticated user uploads a crafted Sieve script containing specific instructions designed to target specific mailbox identifiers. When the LMTP server processes incoming mail, it triggers the Sieve interpreter to evaluate the script. The oracle manifests through the differential behavior of the 'fileinto' command. If a script attempts to file a message into a non-existent or inaccessible mailbox, the Sieve engine reacts differently—often via specific error codes or delivery status notifications (DSNs)—compared to a scenario where the mailbox exists but is constrained by ACLs.\nAn attacker can monitor these delivery outcomes to perform a brute-force or targeted scan of mailbox existence. Furthermore, by targeting shared mailbox annotations, the script can observe execution branches triggered by the retrieval of annotation values. Because the LMTP delivery process provides immediate feedback based on whether a branch was successfully executed, the attacker obtains a binary signal: existence confirmed or existence denied.\nThis side-channel attack is particularly dangerous because it does not trigger standard 'access denied' security events that might be logged by traditional auditing tools. Instead, it leverages the legitimate logic flow of the delivery agent to leak metadata. The exploitability is limited to users who have existing accounts on the system, meaning the threat model is primarily malicious insiders or compromised user accounts. The vulnerability persists across all configurations where Sieve is enabled and where users have the capability to upload arbitrary scripts to their delivery profile. Post-exploitation, an attacker can map the global mailbox structure of the server, identify high-value targets (such as administrator accounts or specific project aliases), and harvest sensitive metadata stored in annotations, significantly lowering the bar for subsequent, more complex targeted attacks."
}