CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html
https://www.cyrusimap.org/imap/download/release-notes/index.html

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en cyrus-imapd en Cyrus IMAP hasta la versión 3.12.2. Los tokens emitidos por GENURLAUTH pueden eludir las ACLs. Cualquier usuario autenticado podría generar un token URLAUTH (a través del comando GENURLAUTH) para cualquier buzón que pudiera nombrar, incluso sin tener acceso de lectura sobre él. Esto permitiría leer correo de los buzones a pesar de no tener permisos concedidos.

Information

Published : 2026-07-16 19:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-47086

Mitre link : CVE-2026-47086

CVE.ORG link : CVE-2026-47086

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-47086", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47086", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T18:46:52.503524Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "cyrusimap", "product": "Cyrus IMAP", "versions": [{"status": "affected", "version": "0", "lessThan": "3.12.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T19:16:49.253", "references": [{"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html", "source": "cve@mitre.org"}, {"url": "https://www.cyrusimap.org/imap/download/release-notes/index.html", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en cyrus-imapd en Cyrus IMAP hasta la versi\u00f3n 3.12.2. Los tokens emitidos por GENURLAUTH pueden eludir las ACLs. Cualquier usuario autenticado podr\u00eda generar un token URLAUTH (a trav\u00e9s del comando GENURLAUTH) para cualquier buz\u00f3n que pudiera nombrar, incluso sin tener acceso de lectura sobre \u00e9l. Esto permitir\u00eda leer correo de los buzones a pesar de no tener permisos concedidos."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "cve@mitre.org"}