CVE-2026-47085

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html
https://www.cyrusimap.org/imap/download/release-notes/index.html

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en cyrus-imapd en Cyrus IMAP hasta la versión 3.12.2. La falsificación de tokens URLAUTH puede ocurrir a través de una mboxkey faltante. Si un atacante conociera el nombre de una carpeta en la cuenta de la víctima para la cual la víctima nunca había emitido una URL de autenticación, podría falsificar un token URLAUTH funcional calculando un valor HMAC-SHA1 con una clave predecible, dándoles acceso de lectura al buzón. (URLAUTH es una característica oscura, lo que significa que las probabilidades de que cualquier usuario sea realmente susceptible a este ataque son muy bajas. Quizás ningún cliente público use URLAUTH).

Information

Published : 2026-07-16 19:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-47085

Mitre link : CVE-2026-47085

CVE.ORG link : CVE-2026-47085

JSON object : View

Products Affected

No product.

CWE

CWE-340

Generation of Predictable Numbers or Identifiers

{"id": "CVE-2026-47085", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47085", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T18:54:08.396648Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "cyrusimap", "product": "Cyrus IMAP", "versions": [{"status": "affected", "version": "0", "lessThan": "3.12.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T19:16:49.120", "references": [{"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html", "source": "cve@mitre.org"}, {"url": "https://www.cyrusimap.org/imap/download/release-notes/index.html", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-340"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)"}, {"lang": "es", "value": "Se descubri\u00f3 un problema en cyrus-imapd en Cyrus IMAP hasta la versi\u00f3n 3.12.2. La falsificaci\u00f3n de tokens URLAUTH puede ocurrir a trav\u00e9s de una mboxkey faltante. Si un atacante conociera el nombre de una carpeta en la cuenta de la v\u00edctima para la cual la v\u00edctima nunca hab\u00eda emitido una URL de autenticaci\u00f3n, podr\u00eda falsificar un token URLAUTH funcional calculando un valor HMAC-SHA1 con una clave predecible, d\u00e1ndoles acceso de lectura al buz\u00f3n. (URLAUTH es una caracter\u00edstica oscura, lo que significa que las probabilidades de que cualquier usuario sea realmente susceptible a este ataque son muy bajas. Quiz\u00e1s ning\u00fan cliente p\u00fablico use URLAUTH)."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "cve@mitre.org"}