CVE-2026-47082

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html
https://www.cyrusimap.org/imap/download/release-notes/index.html

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en cyrus-imapd en Cyrus IMAP hasta la versión 3.12.2. La característica ’fcc’ de vacaciones omite la ACL del buzón de destino. Un usuario cuyo script Sieve de vacaciones usaba :fcc (para guardar una copia del mensaje enviado) podría entregar copias de respuesta automática de vacaciones en cualquier buzón que el script pudiera nombrar, independientemente de si el propietario del script tenía permisos de inserción en el buzón de destino.

Information

Published : 2026-07-16 19:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-47082

Mitre link : CVE-2026-47082

CVE.ORG link : CVE-2026-47082

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-47082", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47082", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T18:48:09.260544Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "cyrusimap", "product": "Cyrus IMAP", "versions": [{"status": "affected", "version": "0", "lessThan": "3.12.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T19:16:48.713", "references": [{"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html", "source": "cve@mitre.org"}, {"url": "https://www.cyrusimap.org/imap/download/release-notes/index.html", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation \"fcc\" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en cyrus-imapd en Cyrus IMAP hasta la versi\u00f3n 3.12.2. La caracter\u00edstica \u2019fcc\u2019 de vacaciones omite la ACL del buz\u00f3n de destino. Un usuario cuyo script Sieve de vacaciones usaba :fcc (para guardar una copia del mensaje enviado) podr\u00eda entregar copias de respuesta autom\u00e1tica de vacaciones en cualquier buz\u00f3n que el script pudiera nombrar, independientemente de si el propietario del script ten\u00eda permisos de inserci\u00f3n en el buz\u00f3n de destino."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "cve@mitre.org"}