CVE-2026-47087

{"id": "CVE-2026-47087", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47087", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T18:59:40.649418Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "cyrusimap", "product": "Cyrus IMAP", "versions": [{"status": "affected", "version": "0", "lessThan": "3.12.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T19:16:49.383", "references": [{"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html", "source": "cve@mitre.org"}, {"url": "https://www.cyrusimap.org/imap/download/release-notes/index.html", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-672"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en cyrus-imapd en Cyrus IMAP hasta la versi\u00f3n 3.12.2. URLAUTH no respeta el acceso revocado del autorizador. Una URL de URLAUTH acu\u00f1ada mientras el autorizador ten\u00eda acceso sigui\u00f3 funcionando despu\u00e9s de que ese acceso fuera revocado."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "cve@mitre.org"}