{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-61910-els_os-oraclelinux6els.json" } ], "tracking": { "current_release_date": "2026-09-17T16:34:29Z", "generator": { "date": "2026-09-17T16:34:29Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-61910-ELS_OS-ORACLELINUX6ELS", "initial_release_date": "2026-09-09T20:18:00Z", "revision_history": [ { "date": "2026-09-09T20:18:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-09-17T12:35:54Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-09-17T16:34:29Z", "number": "3", "summary": "Update document" } ], "status": "final", "version": "3" }, "title": "Security update on CVE-2026-61910" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 6", "product": { "name": "Oracle Linux 6", "product_id": "Oracle-Linux-6", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" }, { "branches": [ { "category": "product_version", "name": "cyrus-imapd-devel-0:2.3.16-15.el6.i686", "product": { "name": "cyrus-imapd-devel-0:2.3.16-15.el6.i686", "product_id": "cyrus-imapd-devel-0:2.3.16-15.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/oracle/cyrus-imapd-devel@2.3.16-15.el6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "cyrus-imapd-devel-0:2.3.16-15.el6.x86_64", "product": { "name": "cyrus-imapd-devel-0:2.3.16-15.el6.x86_64", "product_id": "cyrus-imapd-devel-0:2.3.16-15.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/oracle/cyrus-imapd-devel@2.3.16-15.el6?arch=x86_64" } } }, { "category": "product_version", "name": "cyrus-imapd-0:2.3.16-15.el6.x86_64", "product": { "name": "cyrus-imapd-0:2.3.16-15.el6.x86_64", "product_id": "cyrus-imapd-0:2.3.16-15.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/oracle/cyrus-imapd@2.3.16-15.el6?arch=x86_64" } } }, { "category": "product_version", "name": "cyrus-imapd-utils-0:2.3.16-15.el6.x86_64", "product": { "name": "cyrus-imapd-utils-0:2.3.16-15.el6.x86_64", "product_id": "cyrus-imapd-utils-0:2.3.16-15.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/oracle/cyrus-imapd-utils@2.3.16-15.el6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686", "product": { "name": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686", "product_id": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cyrus-imapd-devel@2.3.16-15.el6.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product": { "name": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product_id": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cyrus-imapd-devel@2.3.16-15.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product": { "name": "cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product_id": "cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cyrus-imapd@2.3.16-15.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product": { "name": "cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product_id": "cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/cyrus-imapd-utils@2.3.16-15.el6.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686" }, "product_reference": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64" }, "product_reference": "cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64" }, "product_reference": "cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64" }, "product_reference": "cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "cyrus-imapd-devel-0:2.3.16-15.el6.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.i686" }, "product_reference": "cyrus-imapd-devel-0:2.3.16-15.el6.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "cyrus-imapd-devel-0:2.3.16-15.el6.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.x86_64" }, "product_reference": "cyrus-imapd-devel-0:2.3.16-15.el6.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "cyrus-imapd-0:2.3.16-15.el6.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:cyrus-imapd-0:2.3.16-15.el6.x86_64" }, "product_reference": "cyrus-imapd-0:2.3.16-15.el6.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "cyrus-imapd-utils-0:2.3.16-15.el6.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:cyrus-imapd-utils-0:2.3.16-15.el6.x86_64" }, "product_reference": "cyrus-imapd-utils-0:2.3.16-15.el6.x86_64", "relates_to_product_reference": "Oracle-Linux-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-61910", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Oracle-Linux-6:cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-0:2.3.16-15.el6.x86_64", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.i686", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.x86_64", "Oracle-Linux-6:cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-utils-0:2.3.16-15.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-61910" }, { "category": "external", "summary": "https://cyrusimap.org", "url": "https://cyrusimap.org/" }, { "category": "external", "summary": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html", "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html" }, { "category": "external", "summary": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html", "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html" }, { "category": "external", "summary": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html", "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html" } ], "release_date": "2026-09-09T20:18:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-09-17T14:02:38.456262Z", "details": "This flaw is only relevant on Cyrus IMAP servers with JMAP enabled and shared mailboxes where a delegate has been explicitly granted maySetKeywords on another user’s mailbox; it provides no code execution, no privilege escalation, and no availability impact. Its effect is limited to changing the mailbox’s special-use annotation (e.g., Archive/Snooze), potentially influencing client auto-filing, and role-duplication suppression blocks the change if the owner already has a non-shared mailbox in that role—so confidentiality impact is narrow and configuration-dependent. Given the need for authenticated access plus specific delegation in a niche sharing setup, it is reasonable to deprioritize in managed enterprise VM/server environments.", "product_ids": [ "Oracle-Linux-6:cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-0:2.3.16-15.el6.x86_64", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.i686", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.x86_64", "Oracle-Linux-6:cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-utils-0:2.3.16-15.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Oracle-Linux-6:cyrus-imapd-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-0:2.3.16-15.el6.x86_64", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.i686", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.i686", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-devel-0:2.3.16-15.el6.x86_64", "Oracle-Linux-6:cyrus-imapd-utils-0:2.3.16-15.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:cyrus-imapd-utils-0:2.3.16-15.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }