CVE-2026-47089

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html
https://www.cyrusimap.org/imap/download/release-notes/index.html

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en cyrus-imapd en Cyrus IMAP hasta la versión 3.12.2. LISTRIGHTS no se limita a usuarios con acceso de administrador. Un usuario autenticado podría invocar IMAP LISTRIGHTS contra cualquier buzón que pudiera nombrar y conocer qué entidades principales tenían qué acceso a él. (Esta acción debería haberse restringido a usuarios con acceso de administrador en el buzón de destino).

Information

Published : 2026-07-16 19:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-47089

Mitre link : CVE-2026-47089

CVE.ORG link : CVE-2026-47089

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-47089", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47089", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T19:01:41.402932Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "cyrusimap", "product": "Cyrus IMAP", "versions": [{"status": "affected", "version": "0", "lessThan": "3.12.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T19:16:49.647", "references": [{"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html", "source": "cve@mitre.org"}, {"url": "https://www.cyrusimap.org/imap/download/release-notes/index.html", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)"}, {"lang": "es", "value": "Se descubri\u00f3 un problema en cyrus-imapd en Cyrus IMAP hasta la versi\u00f3n 3.12.2. LISTRIGHTS no se limita a usuarios con acceso de administrador. Un usuario autenticado podr\u00eda invocar IMAP LISTRIGHTS contra cualquier buz\u00f3n que pudiera nombrar y conocer qu\u00e9 entidades principales ten\u00edan qu\u00e9 acceso a \u00e9l. (Esta acci\u00f3n deber\u00eda haberse restringido a usuarios con acceso de administrador en el buz\u00f3n de destino)."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "cve@mitre.org"}