CVE-2026-47086
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can...
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
- Record
CVE-2026-47086- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-45009
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
- Record
EUVD-2026-45009- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j6pg-f6px-vgh9
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can...
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
- Record
GHSA-j6pg-f6px-vgh9- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
- Record
CVE-2026-47086- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-47086
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
- Record
DEBIAN-CVE-2026-47086- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-47086
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
- Record
UBUNTU-CVE-2026-47086- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21368-1 No score
Security update for cyrus-imapd
This update for cyrus-imapd fixes the following issues:
Changes in cyrus-imapd:
- Update to 3.8.7 (bugfix release)
- CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack (bsc#1271617)
- CVE-2026-47083: ESEARCH cross-user content oracle (bsc#1271619)
- CVE-2026-47082: Vacation "fcc" skips destination-mailbox ACL (bsc#1271618)
- CVE-2026-47084: LOCALDELETE bypassed ACL checks (bsc#1271620)
- CVE-2026-47085: URLAUTH token forgery via missing mboxkey (bsc#1271621)
- CVE-2026-47086: GENURLAUTH issued tokens bypassing ACLs (bsc#1271622)
- CVE-2026-47087: URLAUTH does not honor revoked authorizer access (bsc#1271623)
- CVE-2026-47088: Heap exposure in nested MIME comment parsing (bsc#1271624)
- CVE-2026-47089: LISTRIGHTS not limited to users with admin access (bsc#1271625)
- Record
openSUSE-SU-2026:21368-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cyrus-imapdDebian:12 |
before 3.6.1-4+deb12u5, plus listed versions 3.6.1-43.6.1-4+deb12u13.6.1-4+deb12u23.6.1-4+deb12u33.6.1-4+deb12u4 |
3.6.1-4+deb12u5 |
cyrus-imapdDebian:13 |
before 3.10.2-1+deb13u2, plus listed versions 3.10.2-13.10.2-1+deb13u1 |
3.10.2-1+deb13u2 |
cyrus-imapdDebian:14 |
before 3.12.3-1, plus listed versions 3.10.2-13.12.0-13.12.0-23.12.1-13.12.1-23.12.1-33.12.2-13.12.3-1~bpo13+1 |
3.12.3-1 |
cyrus-imapdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.10-3build12.5.10-3build22.5.10-3ubuntu12.5.10-3ubuntu1.12.5.10-3ubuntu1.1+esm1 |
None known |
cyrus-imapdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.11-13.0.11-1build13.0.12-13.0.12-23.0.12-2ubuntu2 Show 7 moreShow less3.0.12-2ubuntu33.0.13-2ubuntu13.0.13-3ubuntu13.0.13-4ubuntu13.0.13-53.0.13-5ubuntu0.1~esm13.0.13-5ubuntu0.1~esm2 |
None known |
cyrus-imapdUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.2.6-2build13.4.2-23.4.2-2build13.4.3-23.4.3-3 Show 5 moreShow less3.4.3-3build23.4.3-3ubuntu0.13.4.3-3ubuntu0.1+esm13.4.3-3ubuntu0.33.4.3-3ubuntu0.3+esm1 |
None known |
cyrus-imapdUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.8.0-53.8.1-13.8.1-1build13.8.1-1build23.8.1-3 Show 5 moreShow less3.8.1-3build33.8.2-13.8.2-1ubuntu0.1~esm13.8.2-1ubuntu0.23.8.2-1ubuntu0.2+esm1 |
None known |
cyrus-imapdUbuntu:26.10 |
All versions, plus listed versions 3.12.1-33.12.2-13.12.2-1build13.12.3-3build1 |
None known |
cyrus-imapdUbuntu:26.04:LTS |
All versions, plus listed versions 3.10.2-13.12.1-23.12.1-2build13.12.1-3 |
None known |
cyrus-imapdopenSUSE:Leap 16.0 From an advisory covering 9 CVEs |
before 3.8.7-bp160.1.1 | 3.8.7-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47086 is a low vulnerability (CVSS 3.5) in Cyrusimap Cyrus Imap, published July 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in cyrus-imapd 3.6.1-4+deb12u5.
References
cyrusimap.org/imap/download/release-notes/index.html
nvd.nist.gov/vuln/detail/CVE-2026-47086
github.com/advisories/GHSA-j6pg-f6px-vgh9
security-tracker.debian.org/tracker/CVE-2026-47086
ubuntu.com/security/CVE-2026-47086
Show 19 moreShow less
cve.org/CVERecord?id=CVE-2026-47086
bugzilla.suse.com/1271617
suse.com/security/cve/CVE-2026-47081