CVE-2026-47082
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature...
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
- Record
CVE-2026-47082- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-45005
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
- Record
EUVD-2026-45005- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pwfr-vrq6-chw9
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature...
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
- Record
GHSA-pwfr-vrq6-chw9- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
- Record
CVE-2026-47082- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-47082
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
- Record
DEBIAN-CVE-2026-47082- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-47082
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
- Record
UBUNTU-CVE-2026-47082- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21368-1 No score
Security update for cyrus-imapd
This update for cyrus-imapd fixes the following issues:
Changes in cyrus-imapd:
- Update to 3.8.7 (bugfix release)
- CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack (bsc#1271617)
- CVE-2026-47083: ESEARCH cross-user content oracle (bsc#1271619)
- CVE-2026-47082: Vacation "fcc" skips destination-mailbox ACL (bsc#1271618)
- CVE-2026-47084: LOCALDELETE bypassed ACL checks (bsc#1271620)
- CVE-2026-47085: URLAUTH token forgery via missing mboxkey (bsc#1271621)
- CVE-2026-47086: GENURLAUTH issued tokens bypassing ACLs (bsc#1271622)
- CVE-2026-47087: URLAUTH does not honor revoked authorizer access (bsc#1271623)
- CVE-2026-47088: Heap exposure in nested MIME comment parsing (bsc#1271624)
- CVE-2026-47089: LISTRIGHTS not limited to users with admin access (bsc#1271625)
- Record
openSUSE-SU-2026:21368-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cyrus-imapdDebian:12 |
before 3.6.1-4+deb12u5, plus listed versions 3.6.1-43.6.1-4+deb12u13.6.1-4+deb12u23.6.1-4+deb12u33.6.1-4+deb12u4 |
3.6.1-4+deb12u5 |
cyrus-imapdDebian:13 |
before 3.10.2-1+deb13u2, plus listed versions 3.10.2-13.10.2-1+deb13u1 |
3.10.2-1+deb13u2 |
cyrus-imapdDebian:14 |
before 3.12.3-1, plus listed versions 3.10.2-13.12.0-13.12.0-23.12.1-13.12.1-23.12.1-33.12.2-13.12.3-1~bpo13+1 |
3.12.3-1 |
cyrus-imapdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.10-3build12.5.10-3build22.5.10-3ubuntu12.5.10-3ubuntu1.12.5.10-3ubuntu1.1+esm1 |
None known |
cyrus-imapdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.11-13.0.11-1build13.0.12-13.0.12-23.0.12-2ubuntu2 Show 7 moreShow less3.0.12-2ubuntu33.0.13-2ubuntu13.0.13-3ubuntu13.0.13-4ubuntu13.0.13-53.0.13-5ubuntu0.1~esm13.0.13-5ubuntu0.1~esm2 |
None known |
cyrus-imapdUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.2.6-2build13.4.2-23.4.2-2build13.4.3-23.4.3-3 Show 5 moreShow less3.4.3-3build23.4.3-3ubuntu0.13.4.3-3ubuntu0.1+esm13.4.3-3ubuntu0.33.4.3-3ubuntu0.3+esm1 |
None known |
cyrus-imapdUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.8.0-53.8.1-13.8.1-1build13.8.1-1build23.8.1-3 Show 5 moreShow less3.8.1-3build33.8.2-13.8.2-1ubuntu0.1~esm13.8.2-1ubuntu0.23.8.2-1ubuntu0.2+esm1 |
None known |
cyrus-imapdUbuntu:26.10 |
All versions, plus listed versions 3.12.1-33.12.2-13.12.2-1build13.12.3-3build1 |
None known |
cyrus-imapdUbuntu:26.04:LTS |
All versions, plus listed versions 3.10.2-13.12.1-23.12.1-2build13.12.1-3 |
None known |
cyrus-imapdopenSUSE:Leap 16.0 From an advisory covering 9 CVEs |
before 3.8.7-bp160.1.1 | 3.8.7-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47082 is a medium vulnerability (CVSS 5.4) in Cyrusimap Cyrus Imap, published July 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in cyrus-imapd 3.6.1-4+deb12u5.
References
cyrusimap.org/imap/download/release-notes/index.html
nvd.nist.gov/vuln/detail/CVE-2026-47082
github.com/advisories/GHSA-pwfr-vrq6-chw9
security-tracker.debian.org/tracker/CVE-2026-47082
ubuntu.com/security/CVE-2026-47082
Show 19 moreShow less
cve.org/CVERecord?id=CVE-2026-47082
bugzilla.suse.com/1271617
suse.com/security/cve/CVE-2026-47081